fls:tldr:73052

fls: Analyze a single partition, providing the sector offset at which the filesystem starts in the image.

$ fls -r -m ${C:} -o ${sector} ${path-to-image_file}

try on your machine

This command is using the fls tool to retrieve information about the file and directory structures within a disk image file. Let's break down the command:

fls: This is the command being used, which is a part of The Sleuth Kit suite. It is commonly used in digital forensics to examine disk images.
-r: This option specifies that the command should recursively list files and subdirectories, i.e., it will display the contents of directories within directories.
-m ${C:}: This option specifies the file system type to be used for analysis. In this case, it is set to ${C:}, which likely means that it is using the NTFS file system. NTFS is commonly used in Windows operating systems.
-o ${sector}: This option specifies the output format for file and directory entries. ${sector} indicates that the output format should be the starting sector numbers of files and directories along with their names.
${path-to-image_file}: This is the path to the disk image file that the command will be analyzing. You need to replace ${path-to-image_file} with the actual path to the disk image file on your system.

Overall, this command will recursively analyze the disk image file specified by ${path-to-image_file} using the NTFS file system, and it will output the starting sector numbers along with the names of files and directories.

This explanation was created by an AI. In most cases those are correct. But please always be careful and never run a command you are not sure if it is safe.

back to the fls tool