Man Pages in sleuthkit

Section 1: Executable programs or shell commands

blkcalc.1

Converts between unallocated disk unit numbers and regular disk unit numbers.

blkcat.1

Display the contents of file system data unit in a disk image.

blkls.1

List or output file system data units.

blkstat.1

Display details of a file system data unit (i.e. block or sector)

fcat.1

Output the contents of a file based on its name.

ffind.1

Finds the name of the file or directory using a given inode

fiwalk.1

Print the filesystem statistics and exit

fls.1

List file and directory names in a disk image.

fsstat.1

Display general details of a file system

hfind.1

Lookup a hash value in a hash database

icat.1

Output the contents of a file based on its inode number.

ifind.1

Find the meta-data structure that has allocated a given disk unit or file name.

ils.1

List inode information

img_cat.1

Output contents of an image file.

img_stat.1

Display details of an image file

istat.1

Display details of a meta-data structure (i.e. inode)

jcat.1

Show the contents of a block in the file system journal.

jls.1

List the contents of a file system journal

jpeg_extract.1

Jpeg extractor

mactime.1

Create an ascii time line of file activity

mmcat.1

Output the contents of a partition to stdout

mmls.1

Display the partition layout of a volume system (partition tables)

mmstat.1

Display details about the volume system (partition tables)

sigfind.1

Find a binary signature in a file

sorter.1

Sort files in an image into categories based on file type

srch_strings.1

Display printable strings in files

tsk_comparedir.1

Compare the contents of a directory with the contents of an image or local device.

tsk_gettimes.1

Collect mac times from a disk image into a body file.

tsk_loaddb.1

Populate a sqlite database with metadata from a disk image

tsk_recover.1

Export files from an image into a local directory