📦 sleuthkit

B

• blkcalc(1)Converts between unallocated disk unit numbers and regular disk unit numbers.✨
• blkcat(1)Display the contents of file system data unit in a disk image.✨
• blkls(1)List or output file system data units.✨
• blkstat(1)Display details of a file system data unit (i.e. block or sector)✨

F

• fcat(1)Output the contents of a file based on its name.✨
• ffind(1)Finds the name of the file or directory using a given inode✨
• fiwalk(1)print the filesystem statistics and exit✨
• fls(1)List file and directory names in a disk image.✨
• fsstat(1)Display general details of a file system✨

H

• hfind(1)Lookup a hash value in a hash database✨

I

• icat(1)Output the contents of a file based on its inode number.✨
• ifind(1)Find the meta-data structure that has allocated a given disk unit or file name.✨
• ils(1)List inode information✨
• img_cat(1)Output contents of an image file.✨
• img_stat(1)Display details of an image file✨
• istat(1)Display details of a meta-data structure (i.e. inode)✨

J

• jcat(1)Show the contents of a block in the file system journal.✨
• jls(1)List the contents of a file system journal✨
• jpeg_extract(1)jpeg extractor✨

M

• mactime(1)Create an ASCII time line of file activity✨
• mmcat(1)Output the contents of a partition to stdout✨
• mmls(1)Display the partition layout of a volume system (partition tables)✨
• mmstat(1)Display details about the volume system (partition tables)✨

S

• sigfind(1)Find a binary signature in a file✨
• sorter(1)Sort files in an image into categories based on file type✨
• srch_strings(1)display printable strings in files✨

T

• tsk_comparedir(1)compare the contents of a directory with the contents of an image or local device.✨
• tsk_gettimes(1)Collect MAC times from a disk image into a body file.✨
• tsk_loaddb(1)populate a SQLite database with metadata from a disk image✨
• tsk_recover(1)Export files from an image into a local directory✨

U

• usnjls(1)List the contents of a NTFS Update Sequence Number journal✨