1ISTAT(1)                    General Commands Manual                   ISTAT(1)
2
3
4

NAME

6       istat - Display details of a meta-data structure (i.e. inode)
7

SYNOPSIS

9       istat  [-B  num ] [-f fstype ] [-i imgtype] [-o imgoffset] [-b dev_sec‐
10       tor_size] [-vV] [-z zone ] [-s seconds ] image [images] inode
11

DESCRIPTION

13       istat displays the uid,  gid,  mode,  size,  link  number,  modified  ,
14       accessed,  changed  times, and all the disk units a structure has allo‐
15       cated.
16
17       The options are as follows:
18
19       -B num Display the addresses of num disk units.  Useful when the  inode
20              is unallocated with size 0, but still has block pointers.
21
22       -f fstype
23              Specify  the  file  system type.  Use '-f list' to list the sup‐
24              ported file system types.  If not given,  autodetection  methods
25              are used.
26
27       -s seconds
28              The  time  skew of the original system in seconds.  For example,
29              if the original system was 100 seconds slow, this value would be
30              -100.
31
32       -i imgtype
33              Identify  the type of image file, such as raw or split.  Use '-i
34              list' to list the supported types.  If not given,  autodetection
35              methods are used.
36
37       -o imgoffset
38              The sector offset where the file system starts in the image.
39
40       -b dev_sector_size
41              The  size,  in  bytes, of the underlying device sectors.  If not
42              given, the value in the image format is used (if it  exists)  or
43              512-bytes is assumed.
44
45       -v     Verbose output of debugging statements to stderr
46
47       -V     Display version
48
49       -z zone
50              An  ASCII  string of the original system's time zone.  For exam‐
51              ple, EST5EDT or GMT.  These strings are defined by the operating
52              system and may vary.  NOTE: This has changed since TCTUTILs.
53
54       image [images]
55              One  (or more if split) disk or partition images whose format is
56              given with '-i'.
57
58       inode  Meta-data number to display stats on
59
60

AUTHOR

62       Brian Carrier <carrier at sleuthkit dot org>
63
64       Send documentation updates to <doc-updates at sleuthkit dot org>
65
66
67
68                                                                      ISTAT(1)
Impressum