ISTAT

Description

istat displays the uid, gid, mode, size, link number, modified, accessed, changed times, and all the disk units a structure has allocated.

Usage

Syntax

istat [-B num] [-f fstype] [-i imgtype] [-b dev_sector_size] [-o imgoffset] [-z zone] [-s seconds] [-vV] image inum

Options

        -B num: force the display of NUM address of block pointers
	-z zone: time zone of original machine (i.e. EST5EDT or GMT)
	-s seconds: Time skew of original machine (in seconds)
	-i imgtype: The format of the image file (use '-i list' for supported types)
	-b dev_sector_size: The size (in bytes) of the device sectors
	-f fstype: File system type (use '-f list' for supported types)
	-o imgoffset: The offset of the file system in the image (in sectors)
	-v: verbose output to stderr
	-V: print version

Example

cyborg@cyborg:~$ istat  image.dd  1
MFT Entry Header Values:
Entry: 1        Sequence: 1
$LogFile Sequence Number: 1057574
Allocated File
Links: 1

$STANDARD_INFORMATION Attribute Values:
Flags: Hidden, System
Owner ID: 0
Security ID: 256  ()
Created:	Thu Jun  7 22:17:01 2012
File Modified:	Thu Jun  7 22:17:01 2012
MFT Modified:	Thu Jun  7 22:17:01 2012
Accessed:	Thu Jun  7 22:17:01 2012

$FILE_NAME Attribute Values:
Flags: Hidden, System
Name: $MFTMirr
Parent MFT Entry: 5 	Sequence: 5
Allocated Size: 4096   	Actual Size: 4096
Created:	Thu Jun  7 22:17:01 2012
File Modified:	Thu Jun  7 22:17:01 2012
MFT Modified:	Thu Jun  7 22:17:01 2012
Accessed:	Thu Jun  7 22:17:01 2012

Attributes: 
Type: $STANDARD_INFORMATION (16-0)   Name: N/A   Resident   size: 72
Type: $FILE_NAME (48-2)   Name: N/A   Resident   size: 82
Type: $DATA (128-1)   Name: N/A   Non-Resident   size: 4096  init_size: 4096
2
0 Comments

Leave a reply

CONTACT US

We're are building as a community and a team. Be a part of it.

Sending

©2017 Ztrela Knowledge Solutions Pvt. Ltd

Log in with your credentials

Forgot your details?