Linux command
fls 命令
文件
复制后可按需替换文件名、目录或参数。
常用示例
List files in
fls [disk.img]
List deleted files
fls -d [disk.img]
Recursive listing
fls -r [disk.img]
List specific directory
fls [disk.img] [inode]
List with file
fls -p [disk.img]
说明
fls lists file and directory names from disk images. It's part of The Sleuth Kit forensics toolkit and examines filesystem structures directly without mounting. The tool shows regular and deleted file entries, useful for data recovery and forensic analysis. It works with various filesystems including NTFS, FAT, ext, and HFS+. fls enables examining disk images without modifying their contents, preserving forensic integrity.
参数
- -r
- Recursive listing.
- -d
- Show deleted entries.
- -l
- Long format output.
- -p
- Show full paths.
- -m _PREFIX_
- Output in mactime format.
- -o _OFFSET_
- Partition offset.
- --help
- Display help information.
FAQ
What is the fls command used for?
fls lists file and directory names from disk images. It's part of The Sleuth Kit forensics toolkit and examines filesystem structures directly without mounting. The tool shows regular and deleted file entries, useful for data recovery and forensic analysis. It works with various filesystems including NTFS, FAT, ext, and HFS+. fls enables examining disk images without modifying their contents, preserving forensic integrity.
How do I run a basic fls example?
Run `fls [disk.img]` in a terminal, then adjust file names, paths, flags, or remote targets for your system.
What does -r do in fls?
Recursive listing.