Sleuth Kit Praktische Übungen

Anzeigen der Partition Tabelle

• mmls debian1.dd

DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors

      Slot      Start        End          Length       Description
000:  Meta      0000000000   0000000000   0000000001   Primary Table (#0)
001:  -------   0000000000   0000002047   0000002048   Unallocated
002:  000:000   0000002048   0005468159   0005466112   Linux Swap / Solaris x86 (0x82)
003:  000:001   0005468160   0052426751   0046958592   Linux (0x83)
004:  -------   0052426752   0052428799   0000002048   Unallocated

Anzeigen der EXT4 Partion

fsstat -o 5468160 debian1.dd | more

FILE SYSTEM INFORMATION
--------------------------------------------
File System Type: Ext4
Volume Name: 
Volume ID: 3cb5534c0a99fc9e6d463987f2410776

Last Written at: 2024-08-05 13:18:33 (EDT)
Last Checked at: 2022-12-03 04:04:37 (EST)

Last Mounted at: 2024-08-05 13:18:34 (EDT)
Unmounted properly
Last mounted on: /

Source OS: Linux
Dynamic Structure
Compat Features: Journal, Ext Attributes, Resize Inode, Dir Index
InCompat Features: Filetype, Needs Recovery, Extents, 64bit, Flexible Block Groups, 
Read Only Compat Features: Sparse Super, Large File, Huge File, Extra Inode Size

Journal ID: 00
Journal Inode: 8

METADATA INFORMATION
--------------------------------------------
Inode Range: 1 - 1468801
Root Directory: 2
Free Inodes: 1310126
Inode Size: 256
Orphan Inodes: 1057216, 1057065, 1056868, 1056867, 1057017, 1056900, 1057032, 

CONTENT INFORMATION
--------------------------------------------
Block Groups Per Flex Group: 16
Block Range: 0 - 5869823
Block Size: 4096
Free Blocks: 4447898

BLOCK GROUP INFORMATION
--------------------------------------------
Number of Block Groups: 180
Inodes per group: 8160
Blocks per group: 32768