How to Use the Command 'fls' (with Examples)
The ‘fls’ command is part of the Sleuth Kit, a collection of forensic tools used to investigate disk images. ‘fls’ primarily serves as a file and directory lister, enabling users to explore the contents of an image file or device. It is particularly valuable in digital forensics for examining the composition of filesystems in disk images. The command allows users to scrutinize directory structures and file listings, catering to professionals who need to probe the internal workings of storage mediums efficiently.
Use Case 1: Build a Recursive fls List Over a Device, Output Paths Will Start with C:
Code:
fls -r -m C: /dev/loop1p1
Motivation:
Imagine you’re a digital forensic investigator tasked with analyzing a disk image from a suspect’s device. You need to extract a detailed list of the files and directories, including hidden files, in a format that matches the original layout of the system for further analysis. This command provides a non-intrusive way to recursively traverse the file system and document its structure, allowing for comprehensive inspection without altering the original data.
Explanation:
fls: This is the command from the Sleuth Kit that lists files and directories.-r: This flag enables recursive listing, meaning it will explore directories and subdirectories comprehensively.-m C:: This flag is used to set the mount point for all listed paths in the output, emulating the original drive letter allocation (e.g., “C:” for Windows systems)./dev/loop1p1: This specifies the device file representing the partition of interest. It is typically used in a Linux environment where loopback devices are employed to access disk images.
Example Output:
C:/file1.txt
C:/folder1/file2.jpg
C:/folder2/subfolder1/file3.docx
C:/folder3/subfolder2/file4.mp3
Use Case 2: Analyze a Single Partition, Providing the Sector Offset at Which the Filesystem Starts in the Image
Code:
fls -r -m C: -o sector path/to/image_file
Motivation:
Often, disk images are composed of multiple partitions, and each partition doesn’t necessarily start at the very beginning of the image. A forensic examiner might need to narrow their focus to analyze a specific partition by compensating for the offset caused by preceding partitions. This command allows for a targeted examination, enabling the investigator to accurately reflect the logical start of the filesystem within a complex image file.
Explanation:
fls: Again, serving to list files and directories within a filesystem.-r: Enables the recursive listing of contents, thoroughly exploring the partition.-m C:: Sets the path prefix in the output, mimicking the original system’s convention.-o sector: Indicates the sector offset at which the filesystem starts in the disk image, critical for extracting an accurate file list.path/to/image_file: Points to the specific image file being investigated, containing the partition of interest.
Example Output:
C:/docs/sample1.txt
C:/docs/sample2.pdf
C:/music/track1.mp3
C:/music/track2.mp3
Use Case 3: Analyze a Single Partition, Providing the Timezone of the Original System
Code:
fls -r -m C: -z timezone /dev/loop1p1
Motivation:
In some forensic investigations, the timestamp of file modifications, accesses, or creations can be critical. These timestamps are commonly affected by the timezone settings of the original system. For reports to reflect original timings accurately, adjusting to the correct timezone is necessary. By providing the timezone, the investigator ensures that timestamp information is correctly interpreted and represented.
Explanation:
fls: The command employed to list directory contents.-r: Ensures a deep dive into directories to list all files recursively.-m C:: Specifies the mount point as C:, suggesting emulation of a Windows layout.-z timezone: Adjusts all timestamps to reflect the defined timezone, crucial when the original system operated in a different time zone./dev/loop1p1: Identifies the specific device or partition to be analyzed.
Example Output:
C:/video/movie.mp4
C:/projects/report.docx
C:/projects/spreadsheet.xlsx
Conclusion:
The ‘fls’ command is a powerful utility in the forensic toolkit, offering versatility in examining the content structure of disk images. Its ability to operate recursively, adjust for offsets, and cater to timezone differences makes it indispensable for forensic analysts. Each use case discussed provides a specialized approach to extracting filesystem information, ensuring detailed and contextually accurate data retrieval in a forensic context.
