ISTAT(1) General Commands Manual ISTAT(1)NAME
istat - Display details of a meta-data structure (i.e. inode)
SYNOPSIS
istat [-B num ] [-f fstype ] [-i imgtype] [-o imgoffset] [-b dev_sector_size] [-vV] [-z zone ] [-s seconds ] image [images] inode
DESCRIPTION
istat displays the uid, gid, mode, size, link number, modified , accessed, changed times, and all the disk units a structure has allocated.
The options are as follows:
-B num Display the addresses of num disk units. Useful when the inode is unallocated with size 0, but still has block pointers.
-f fstype
Specify the file system type. Use '-f list' to list the supported file system types. If not given, autodetection methods are used.
-s seconds
The time skew of the original system in seconds. For example, if the original system was 100 seconds slow, this value would be
-100.
-i imgtype
Identify the type of image file, such as raw or split. Use '-i list' to list the supported types. If not given, autodetection
methods are used.
-o imgoffset
The sector offset where the file system starts in the image.
-b dev_sector_size
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or
512-bytes is assumed.
-v Verbose output of debugging statements to stderr
-V Display version
-z zone
An ASCII string of the original system's time zone. For example, EST5EDT or GMT. These strings are defined by the operating system
and may vary. NOTE: This has changed since TCTUTILs.
image [images]
One (or more if split) disk or partition images whose format is given with '-i'.
inode Meta-data number to display stats on
AUTHOR
Brian Carrier <carrier at sleuthkit dot org>
Send documentation updates to <doc-updates at sleuthkit dot org>
ISTAT(1)
Check Out this Related Man Page
JLS(1) General Commands Manual JLS(1)NAME
jls - List the contents of a file system journal
SYNOPSIS
jls [-f fstype ] [-vV] [-i imgtype] [-o imgoffset] [-b dev_sector_size] image [images] [inode]
DESCRIPTION
jls lists the records and entries in a file system journal. If inode is given, then it will look there for a journal. Otherwise, it will
use the default location. The output lists the journal block number and a description.
ARGUMENTS -f fstype
Specify the file system type. Use '-f list' to list the supported file system types. If not given, autodetection methods are used.
-i imgtype
Identify the type of image file, such as raw or split. Use '-i list' to list the supported types. If not given, autodetection meth-
ods are used.
-o imgoffset
The sector offset where the file system starts in the image.
-b dev_sector_size
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or
512-bytes is assumed.
-V Display version
-v verbose output
image [images]
One (or more if split) disk or partition images whose format is given with '-i'.
[inode]
The inode where the file system journal can be found.
EXAMPLES
jls -f linux-ext3 img.dd
AUTHOR
Brian Carrier <carrier at sleuthkit dot org>
Send documentation updates to <doc-updates at sleuthkit dot org>
JLS(1)
I have a HP Netserver 2000 running SCO UNIX 5.0.6. I get the message: istat=0a: LSS_PAR on ha=1 sist0=41 sist1=00 !!!! dstat =81 on ha=1 has DS_OPC while WAIT DISCONNECT, rp=c014f8co dsp=FD on path=1, newdsp=FD064600 WARNING: Parity Error MSG OUT=00000006 Failed, 1code=80000002 on ha=1 id... (0 Replies)
I got the command :
istat filename
shows all the file details like owner and group name.
But
i want to know, who has accessed the file last time.
As istat shows the name of owner of that file and name of the group.
istat does lots of my work but i want to know who has accessed my file... (0 Replies)
I got the command :
istat filename
shows all the file details like owner and group name.
But
i want to know, who has accessed the file last time.
As istat shows the name of owner of that file and name of the group.
istat does lots of my work but i want to know who has accessed my file... (2 Replies)
How to get the filename of which has been deleted if I know the inode number.
i can use the command "istat" to get the inode number of the file.
# istat
/proc//fd/x
If this file has been deleted,but the process of this file has not been closed and handle has not been released ,so this... (3 Replies)
I would like to determine if a file is older than a particular date. I found that istat will let me see the date and time of a file older than a year, but I need to change the format. Could anyone help me reformat the following date to a variable (a one liner would be great).
Output from istat -... (1 Reply)
Hi, I am using CENTOS and for now, I am not able to install or to configure the istat command on Linux. So, is there a way to do the same that the shell is doing below, but not using istat command? I would appreciate any help on it.
#!/bin/sh
HOUR=0
MONTHN=0
if
then
:
else
... (10 Replies)