ISTAT(1)

NAME
istat - Display details of a meta-data structure (i.e. inode)

SYNOPSIS
istat [-b num ] [-f fstype ] [-vV] [-z zone ] [-s seconds ] image inode

DESCRIPTION
istat displays the uid, gid, mode, size, link number, modified , accessed, changed times, and all the disk units a structure has allocated. The options are as follows:

-b num
    Display the addresses of num disk units. Useful when the inode is unallocated with size 0, but still has block pointers.

-f fstype
    Specify the file system type. Use the -? option for supported types. If not given, the default type for the platform is used.

-s seconds
    The time skew of the original system in seconds. For example, if the original system was 100 seconds slow, this value would be -100.

-v  Verbose output of debugging statements to stderr

-V  Display version

-z zone
    ASCII string of time zone of original system. For example, EST or GMT. These strings are defined by the operating system and may vary. NOTE: This has changed since TCTUTILs.

image
    Forensic partition image created by dd(1).

inode
    Meta-data number to display stats on

SEE ALSO
dd(1), ils(1)

HISTORY
istat first appeared in TCTUTILs v1.0.

AUTHOR
Brian Carrier <carrier@sleuthkit.org>