tsk_loaddb(1) [debian man page]

TSK_LOADDB(1)						      General Commands Manual						     TSK_LOADDB(1)

NAME

       tsk_loaddb - populate a SQLite database with metadata from a disk image

SYNOPSIS

       tsk_loaddb [-vVk] [-i imgtype ] [-b dev_sector_size ] [-i imgtype ] [-d output_dir ] image

DESCRIPTION

       tsk_loaddb  loads  disk information from image to a sqlite database.  This database can then be used by tools in other languages for analy-
       sis. By default, the database is stored in the same directory as the image with ".db" appended to the name.

       The arguments are as follows:

       -d output_dir
	      specify a directory to output the database file to (must be an existing directory) if not specified the database file will  be  cre-
	      ated in the same directory as the image file

       -v     verbose output to stderr

       -V     Print version

       -k     Don't  create  block  data table.  This table maps each block to the file that allocated it.  This option will make this program run
	      faster.

       -i imgtype
	      The format of the image file (use '-i list' for supported types)

       -b dev_sector_size
	      The size (in bytes) of the device sectors If -i or -b are not given, autodetection methods are used.

EXAMPLES

       To load image data from image.dd to image.dd.db:

	    # tsk_loaddb ./image.dd

AUTHOR

       Brian Carrier <carrier at sleuthkit dot org>

       Send documentation updates to <doc-updates at sleuthkit dot org>

																     TSK_LOADDB(1)

TSK_GETTIMES(1) 					      General Commands Manual						   TSK_GETTIMES(1)

NAME

       tsk_gettimes - Collect MAC times from a disk image into a body file.

SYNOPSIS

       tsk_gettimes [-vV] [-i imgtype ] [-b dev_sector_size ] [-z zone ] [-s seconds ] image

DESCRIPTION

       tsk_gettimes examines each of the file systems in a disk image and returns the data about them in the MACtime body format (the same as run-
       ning 'fls -m' on each file system).  The output of this can be used as input to mactime to make a timeline of file activity.  The  data	is
       printed to STDOUT, which can then be redirected to a file.

       The arguments are as follows:

       -v     verbose output to stderr

       -V     Print version

       -i imgtype
	      The format of the image file (use '-i list' for supported types) If not given, autodetection methods are used.

       -b dev_sector_size
	      The size (in bytes) of the device sectors If not given, autodetection methods are used.

       -s seconds
	      The  time  skew  of  the	original system in seconds.  For example, if the original system was 100 seconds slow, this value would be
	      -100.

       -z zone
	      The ASCII string of the time zone of the original system.  For example, EST or GMT.  These strings must be defined by your operating
	      system and may vary.

EXAMPLES

       To collect data about image image.dd:

	    # tsk_gettimes ./image.dd > body.txt

AUTHOR

       Brian Carrier <carrier at sleuthkit dot org>

       Send documentation updates to <doc-updates at sleuthkit dot org>

																   TSK_GETTIMES(1)