fls

List files and directories in an image file or device. More information: <https://wiki.sleuthkit.org/index.php?title=Fls>.

Install

All systems
curl cmd.cat/fls.sh
Debian Debian
apt-get install sleuthkit
Ubuntu
apt-get install sleuthkit
Alpine
apk add sleuthkit
Arch Arch Linux
pacman -S sleuthkit
image/svg+xml Kali Linux
apt-get install sleuthkit
Fedora
dnf install sleuthkit
Windows (WSL2)
sudo apt-get update sudo apt-get install sleuthkit
OS X
brew install sleuthkit
Raspbian
apt-get install sleuthkit
Dockerfile
dockerfile.run/fls
Docker
docker run cmd.cat/fls fls powered by Commando

List files and directories in an image file or device. More information: <https://wiki.sleuthkit.org/index.php?title=Fls>.

  • Build a recursive fls list over a device, output paths will start with C:
    fls -r -m C: /dev/loop1p1
  • Analyze a single partition, providing the sector offset at which the filesystem starts in the image:
    fls -r -m C: -o sector path/to/image_file
  • Analyze a single partition, providing the timezone of the original system:
    fls -r -m C: -z timezone /dev/loop1p1

© tl;dr; authors and contributors