#Sleuthkit - tools for forensics analysis on volume and filesystem

#FLS Notes

sudo apt install sleuthkit

#create empty img file

dd bs=512 count=500 if=/dev/zero of=test.img

#format it as FAT file system
mkfs.vfat test.img

#check that it's formatted with file
file test.img


#mount the image

mkdir mnt
sudo mount test.img mnt

#create some folders and file
sudo mkdir mnt/folder_{1..5}/

sudo mkdir mnt/folder_{1..5}/subfolder_{a..c}
sudo touch mnt/folder_1/file_{A..G}.txt

#unmount img

sudo umount mnt

#list main directories

fls test.img

#list subdirectories

fls -r test.img

#list with full path name
fls -rp test.img

#Deleted files
sudo mount test.img mnt

rm mnt/folder_1/file_A.txt
rm mnt/folder_1/file_B.txt
sudo umount mnt

fls -rp test.img #note the * next to the deleted files
#list only deleted file

fls -rpd test.img

#list Only Directories

fls -rpD test.img

#list only files

fls -rpF test.img

#list only output from a directory by using its "inode" number

fls -rpD test.img 12

#list supported fstypes
fls -f list