1ISTAT(1) General Commands Manual ISTAT(1)
2
3
4
6 istat - Display details of a meta-data structure (i.e. inode)
7
9 istat [-B num ] [-f fstype ] [-i imgtype] [-o imgoffset] [-b dev_sec‐
10 tor_size] [-vV] [-z zone ] [-s seconds ] image [images] inode
11
13 istat displays the uid, gid, mode, size, link number, modified ,
14 accessed, changed times, and all the disk units a structure has allo‐
15 cated.
16
17 The options are as follows:
18
19 -B num Display the addresses of num disk units. Useful when the inode
20 is unallocated with size 0, but still has block pointers.
21
22 -f fstype
23 Specify the file system type. Use '-f list' to list the sup‐
24 ported file system types. If not given, autodetection methods
25 are used.
26
27 -s seconds
28 The time skew of the original system in seconds. For example,
29 if the original system was 100 seconds slow, this value would be
30 -100.
31
32 -i imgtype
33 Identify the type of image file, such as raw or split. Use '-i
34 list' to list the supported types. If not given, autodetection
35 methods are used.
36
37 -o imgoffset
38 The sector offset where the file system starts in the image.
39
40 -b dev_sector_size
41 The size, in bytes, of the underlying device sectors. If not
42 given, the value in the image format is used (if it exists) or
43 512-bytes is assumed.
44
45 -v Verbose output of debugging statements to stderr
46
47 -V Display version
48
49 -z zone
50 An ASCII string of the original system's time zone. For exam‐
51 ple, EST5EDT or GMT. These strings are defined by the operating
52 system and may vary. NOTE: This has changed since TCTUTILs.
53
54 image [images]
55 One (or more if split) disk or partition images whose format is
56 given with '-i'.
57
58 inode Meta-data number to display stats on
59
60
62 Brian Carrier <carrier at sleuthkit dot org>
63
64 Send documentation updates to <doc-updates at sleuthkit dot org>
65
66
67
68 ISTAT(1)