#Sleuthkit - tools for forensics analysis on volume and filesystem
#FLS Notes
sudo apt install sleuthkit

#create empty img file
dd bs=512 count=500 if=/dev/zero of=test.img

#format it as FAT file system
mkfs.vfat test.img

#check that it's formatted with file
file test.img

#mount the image
mkdir mnt
sudo mount test.img mnt

#create some folders and file
sudo mkdir mnt/folder_{1..5}/
sudo mkdir mnt/folder_{1..5}/subfolder_{a..c}
sudo touch mnt/folder_1/file_{A..G}.txt

#unmount img
sudo umount mnt

#list main directories
fls test.img

#list subdirectories
fls -r test.img

#list with full path name
fls -rp test.img

#Deleted files
sudo mount test.img mnt
rm mnt/folder_1/file_A.txt
rm mnt/folder_1/file_B.txt
sudo umount mnt

fls -rp test.img #note the * next to the deleted files
#list only deleted file
fls -rpd test.img

#list Only Directories
fls -rpD test.img

#list only files
fls -rpF test.img

#list only output from a directory by using its "inode" number
fls -rpD test.img 12

#list supported fstypes
fls -f list