TSK_GETTIMES(1) General Commands Manual TSK_GETTIMES(1)NAME
tsk_gettimes - Collect MAC times from a disk image into a body file.
SYNOPSIS
tsk_gettimes [-vV] [-i imgtype ] [-b dev_sector_size ] [-z zone ] [-s seconds ] image
DESCRIPTION
tsk_gettimes examines each of the file systems in a disk image and returns the data about them in the MACtime body format (the same as run-
ning 'fls -m' on each file system). The output of this can be used as input to mactime to make a timeline of file activity. The data is
printed to STDOUT, which can then be redirected to a file.
The arguments are as follows:
-v verbose output to stderr
-V Print version
-i imgtype
The format of the image file (use '-i list' for supported types) If not given, autodetection methods are used.
-b dev_sector_size
The size (in bytes) of the device sectors If not given, autodetection methods are used.
-s seconds
The time skew of the original system in seconds. For example, if the original system was 100 seconds slow, this value would be
-100.
-z zone
The ASCII string of the time zone of the original system. For example, EST or GMT. These strings must be defined by your operating
system and may vary.
EXAMPLES
To collect data about image image.dd:
# tsk_gettimes ./image.dd > body.txt
AUTHOR
Brian Carrier <carrier at sleuthkit dot org>
Send documentation updates to <doc-updates at sleuthkit dot org>
TSK_GETTIMES(1)
Check Out this Related Man Page
ISTAT(1) General Commands Manual ISTAT(1)NAME
istat - Display details of a meta-data structure (i.e. inode)
SYNOPSIS
istat [-B num ] [-f fstype ] [-i imgtype] [-o imgoffset] [-b dev_sector_size] [-vV] [-z zone ] [-s seconds ] image [images] inode
DESCRIPTION
istat displays the uid, gid, mode, size, link number, modified , accessed, changed times, and all the disk units a structure has allocated.
The options are as follows:
-B num Display the addresses of num disk units. Useful when the inode is unallocated with size 0, but still has block pointers.
-f fstype
Specify the file system type. Use '-f list' to list the supported file system types. If not given, autodetection methods are used.
-s seconds
The time skew of the original system in seconds. For example, if the original system was 100 seconds slow, this value would be
-100.
-i imgtype
Identify the type of image file, such as raw or split. Use '-i list' to list the supported types. If not given, autodetection
methods are used.
-o imgoffset
The sector offset where the file system starts in the image.
-b dev_sector_size
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or
512-bytes is assumed.
-v Verbose output of debugging statements to stderr
-V Display version
-z zone
An ASCII string of the original system's time zone. For example, EST5EDT or GMT. These strings are defined by the operating system
and may vary. NOTE: This has changed since TCTUTILs.
image [images]
One (or more if split) disk or partition images whose format is given with '-i'.
inode Meta-data number to display stats on
AUTHOR
Brian Carrier <carrier at sleuthkit dot org>
Send documentation updates to <doc-updates at sleuthkit dot org>
ISTAT(1)
hi,
I am trying to embed an image to the body of the email, but the image is not visible.
echo "<html>
<body>
<style>
body {background-color:blue}
</style>
<h1>hello</h1>
<center>
<img... (1 Reply)
I have jpg file in my server. I am facing difficulty while sending the image in body . appreciate your help to fix to below code.
echo "--FILEBOUNDARY"
echo "Content-Type: image/jpg"
echo "Content-Disposition: inline; filename=\"tick.jpg\""
echo... (3 Replies)
Continuing to think Vue.js is AWESOME, we now have a new badges timeline in version 0.26 of the UserCP Mockup:
https://www.unix.com/cp/index.php#/pages/badges
Changes:
Added Mockup from Badges timeline.
Changed notifications (upper right) to use v-for: bindings.
Fixes minor vue routing... (0 Replies)