List all files in directory in image using the sleuthkit but without using fls











up vote
1
down vote

favorite












I want to list all files in a directory in a E01 image using the Sleuthkit. The only problem is that i can't use the fls command. I have the inode number of the directory being 145 and the directory name which is /Users/Hello/Pictures/test.



The output when using the fls command is: 



fls -f ntfs -o 2048 Thisimage.E01 145



-/r * 216-128-2:    Hello1.jpg

-/r * 217-128-2:    Bye.jpg

-/r * 218-128-2:    TheFATlady.jpg

-/r * 219-128-2:    Snape.jpg

-/r * 220-128-2:    Amazeing.jpg

-/r * 221-128-2:    Thumbs.db`


Now i need to get the same using the Sleuthkit but not fls. I am not allowed to mount the file. I hope someone can help i've been stuck on this assignment for days now.






linux ubuntu







share|improve this question


























    up vote
    1
    down vote

    favorite












    I want to list all files in a directory in a E01 image using the Sleuthkit. The only problem is that i can't use the fls command. I have the inode number of the directory being 145 and the directory name which is /Users/Hello/Pictures/test.



    The output when using the fls command is: 



    fls -f ntfs -o 2048 Thisimage.E01 145
    

    
-/r * 216-128-2:    Hello1.jpg
    
-/r * 217-128-2:    Bye.jpg
    
-/r * 218-128-2:    TheFATlady.jpg
    
-/r * 219-128-2:    Snape.jpg
    
-/r * 220-128-2:    Amazeing.jpg
    
-/r * 221-128-2:    Thumbs.db`


    Now i need to get the same using the Sleuthkit but not fls. I am not allowed to mount the file. I hope someone can help i've been stuck on this assignment for days now.






    linux ubuntu







    share|improve this question
























      up vote
      1
      down vote

      favorite









      up vote
      1
      down vote

      favorite











      I want to list all files in a directory in a E01 image using the Sleuthkit. The only problem is that i can't use the fls command. I have the inode number of the directory being 145 and the directory name which is /Users/Hello/Pictures/test.



      The output when using the fls command is: 



      fls -f ntfs -o 2048 Thisimage.E01 145
      

      
-/r * 216-128-2:    Hello1.jpg
      
-/r * 217-128-2:    Bye.jpg
      
-/r * 218-128-2:    TheFATlady.jpg
      
-/r * 219-128-2:    Snape.jpg
      
-/r * 220-128-2:    Amazeing.jpg
      
-/r * 221-128-2:    Thumbs.db`


      Now i need to get the same using the Sleuthkit but not fls. I am not allowed to mount the file. I hope someone can help i've been stuck on this assignment for days now.






      linux ubuntu







      share|improve this question













      I want to list all files in a directory in a E01 image using the Sleuthkit. The only problem is that i can't use the fls command. I have the inode number of the directory being 145 and the directory name which is /Users/Hello/Pictures/test.



      The output when using the fls command is: 



      fls -f ntfs -o 2048 Thisimage.E01 145
      

      
-/r * 216-128-2:    Hello1.jpg
      
-/r * 217-128-2:    Bye.jpg
      
-/r * 218-128-2:    TheFATlady.jpg
      
-/r * 219-128-2:    Snape.jpg
      
-/r * 220-128-2:    Amazeing.jpg
      
-/r * 221-128-2:    Thumbs.db`


      Now i need to get the same using the Sleuthkit but not fls. I am not allowed to mount the file. I hope someone can help i've been stuck on this assignment for days now.






      linux ubuntu




      linux ubuntu






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked Nov 13 at 10:39









      user2492483

      83




      83





























          active

          oldest

          votes











          Your Answer






          StackExchange.ifUsing("editor", function () {
          StackExchange.using("externalEditor", function () {
          StackExchange.using("snippets", function () {
          StackExchange.snippets.init();
          });
          });
          }, "code-snippets");

          StackExchange.ready(function() {
          var channelOptions = {
          tags: "".split(" "),
          id: "1"
          };
          initTagRenderer("".split(" "), "".split(" "), channelOptions);

          StackExchange.using("externalEditor", function() {
          // Have to fire editor after snippets, if snippets enabled
          if (StackExchange.settings.snippets.snippetsEnabled) {
          StackExchange.using("snippets", function() {
          createEditor();
          });
          }
          else {
          createEditor();
          }
          });

          function createEditor() {
          StackExchange.prepareEditor({
          heartbeatType: 'answer',
          convertImagesToLinks: true,
          noModals: true,
          showLowRepImageUploadWarning: true,
          reputationToPostImages: 10,
          bindNavPrevention: true,
          postfix: "",
          imageUploader: {
          brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
          contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
          allowUrls: true
          },
          onDemand: true,
          discardSelector: ".discard-answer"
          ,immediatelyShowMarkdownHelp:true
          });


          }
          });














           

          draft saved


          draft discarded


















          StackExchange.ready(
          function () {
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53279164%2flist-all-files-in-directory-in-image-using-the-sleuthkit-but-without-using-fls%23new-answer', 'question_page');
          }
          );

          Post as a guest















          Required, but never shown






























          active

          oldest

          votes













          active

          oldest

          votes









          active

          oldest

          votes






          active

          oldest

          votes
















           

          draft saved


          draft discarded



















































           


          draft saved


          draft discarded














          StackExchange.ready(
          function () {
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53279164%2flist-all-files-in-directory-in-image-using-the-sleuthkit-but-without-using-fls%23new-answer', 'question_page');
          }
          );

          Post as a guest















          Required, but never shown





















































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown

































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown







          -

          Popular posts from this blog

          How to change which sound is reproduced for terminal bell?

          Image
          3 Recently upgrade to 18.10 from 18.04, and using the terminal is becoming annoying: the new alert sound is a drip ( /usr/share/sounds/gnome/default/alerts/drip.ogg ), and the previous one is still located at ( /usr/share/sounds/ubuntu/stereo/bell.ogg ). My issue is that at the gnome-terminal, when autocompleting or pressing left BOTH sounds are reproduced, at the same time. I want to just have ubuntu/stereo/bell.ogg active, not both . At the moment I have been only able to reduce the volume of the alerts (but still both are played), or turn the alerts down (but I dislike both "solutions"). gnome-terminal 18.10 teminal-bell share | improve this question
          Read more

          Can I use Tabulator js library in my java Spring + Thymeleaf project?

          Image
          0 I want to add Tabulator js to my java project. I added tabulator.min.js, tabulator.min.css to resources folder. After that added to my html page these dependencies as recommending in readme.md. <link rel="stylesheet" th:href="@{/css/tabulator.min.css}"> <script type="text/javascript" th:src="@{/js/tabulator.min.js}"></script> Now my tables view all elements, that I have in the html page, but not correct. In the documentation of Tabulator is example how to create header and table, var table = new Tabulator("#example-table", { columns:[ {title:"Name", field:"name", sorter:"string", width:200, editor:true}, {title:"Age", field:"age", sorter:"
          Read more

          Title Spacing in Bjornstrup Chapter, Removing Chapter Number From Contents

          Image
          up vote 5 down vote favorite 2 I would like to make it so that the vertical space below the title of each chapter is the same when using the Bjornstrup package (i.e. so that the descenders do not affect the spacing - as shown by the red arrow in the picture below). I think I'm fairly happy with the spacing around "A chapter", so I'd really like titles without descenders (e.g. "Contents") to have the same vertical spacing as "A chapter" below the title. I would also like to remove the large "0" in the contents title. Any help appreciated, as always. documentclass[11pt,a4paper]{book} % Packages[![enter image description here][1]][1] usepackage[left=3.5cm, right=3.5cm, top=4.3cm, bottom=4.25cm]{geometry} usepackage[utf8]{inputenc} usepackage{libertine} usepackage[libertine]{newtx
          Read more