Digital Forensics with The Sleuth Kit - fls
In The Sleuth Kit (TSK), “fls” is a command line tool used to recover or display information about the files and directories in a given image or file system. “fls” works by reading the file system metadata, such as the file allocation table (FAT) or inode tables, to locate the files and directories of interest. The tool then generates a list of file and directory names, along with other relevant information such as timestamps, inode numbers, and file sizes.
The “fls” tool is commonly used in digital forensics and incident response to quickly locate specific files or directories within an image or file system, or to generate a directory tree for analysis. The output of “fls” can be used in conjunction with other tools, such as “icat”, to recover or display the contents of specific files.
