Linux command
ils 命令
文件
Copy it and replace filenames, paths, or keywords as needed.
命令示例
List inodes
ils [image.dd]
Show allocated only
ils -a [image.dd]
Show unallocated only
ils -e [image.dd]
Specify offset
ils -o [2048] [image.dd]
Machine output
ils -m [image.dd]
说明
ils lists inode information from filesystem images. It's part of The Sleuth Kit for digital forensics. The tool shows inode metadata for allocated and deleted files. It's useful for file recovery and forensic analysis.
参数
- -a
- Show allocated only.
- -e
- Show unallocated only.
- -o _OFFSET_
- Partition offset.
- -m
- Machine-readable output.
- -f _FSTYPE_
- Filesystem type.
- --help
- Display help information.
FAQ
What is the ils command used for?
ils lists inode information from filesystem images. It's part of The Sleuth Kit for digital forensics. The tool shows inode metadata for allocated and deleted files. It's useful for file recovery and forensic analysis.
How do I run a basic ils example?
Run `ils [image.dd]` in a terminal, then adjust file names, paths, flags, or remote targets for your system.
What does -a do in ils?
Show allocated only.