1ISTAT(1)                    General Commands Manual                   ISTAT(1)
2
3
4

NAME

6       istat - Display details of a meta-data structure (i.e. inode)
7

SYNOPSIS

9       istat  [-B  num ] [-f fstype ] [-i imgtype] [-o imgoffset] [-b dev_sec‐
10       tor_size] [-vV] [-z zone ] [-s seconds ] image [images] inode
11

DESCRIPTION

13       istat displays  the  uid,  gid,  mode,  size,  link  number,  modified,
14       accessed,  changed  times, and all the disk units a structure has allo‐
15       cated.
16
17       The options are as follows:
18
19       -B num Display the addresses of num disk units.  Useful when the  inode
20              is unallocated with size 0, but still has block pointers.
21
22       -f fstype
23              Specify  the  file  system type.  Use '-f list' to list the sup‐
24              ported file system types.  If not given,  autodetection  methods
25              are used.
26
27       -s seconds
28              The  time  skew of the original system in seconds.  For example,
29              if the original system was 100 seconds slow, this value would be
30              -100.
31
32       -i imgtype
33              Identify  the type of image file, such as raw.  Use '-i list' to
34              list the supported types.  If not given,  autodetection  methods
35              are used.
36
37       -o imgoffset
38              The sector offset where the file system starts in the image.
39
40       -b dev_sector_size
41              The  size,  in  bytes, of the underlying device sectors.  If not
42              given, the value in the image format is used (if it  exists)  or
43              512-bytes is assumed.
44
45       -v     Verbose output of debugging statements to stderr
46
47       -V     Display version
48
49       -z zone
50              An  ASCII  string of the original system's time zone.  For exam‐
51              ple, EST5EDT or GMT.  These strings are defined by the operating
52              system and may vary.  NOTE: This has changed since TCTUTILs.
53
54       image [images]
55              The  disk or partition image to read, whose format is given with
56              '-i'.  Multiple image file names can be given if  the  image  is
57              split  into multiple segments.  If only one image file is given,
58              and its name is the first in a sequence (e.g., as  indicated  by
59              ending  in  '.001'),  subsequent image segments will be included
60              automatically.
61
62       inode  Meta-data number to display stats on
63
64

AUTHOR

66       Brian Carrier <carrier at sleuthkit dot org>
67
68       Send documentation updates to <doc-updates at sleuthkit dot org>
69
70
71
72                                                                      ISTAT(1)
Impressum