Giters

sleuthkit / sleuthkit

The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.

Home Page:http://www.sleuthkit.org/sleuthkit/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

The `fls -l` command should show sector numbers of files and folders.

HT-7 opened this issue · comments

commented

In IsoBuster, the "LBA" (Logical Block Address) of listed files is visible. "Logical" means it's relative to the beginning of the file system, where as "Physical" would mean for the entire block device.

As a bonus, IsoBuster also can show the individual segments (also known as "fragments" and "cluster chain") and the end LBA.

For fls, at least the beinning LBA or byte of each listed file should be shown.

The istat tool is able to show the occupied sectors on an individual file basis, but fls -l -r should do that on a list basis, for all files with one command.

Thank you for considering this suggestion.