Sleuthkit
- blkcalc(1) Converts between unallocated disk unit numbers and regular
- blkcat(1) Display the contents of file system data unit in a disk image.
- blkls(1) List or output file system data units.
- blkstat(1) Display details of a file system data unit (i.e. block or sector)
- fcat(1) fcat - Output the contents of a file based on its name.
- ffind(1) Finds the name of the file or directory using a given inode
- fiwalk(1) fiwalk - print the filesystem statistics and exit
- fls(1) List file and directory names in a disk image.
- fsstat(1) Display general details of a file system
- hfind(1) Lookup a hash value in a hash database
- icat(1) Output the contents of a file based on its inode number.
- ifind(1) Find the meta-data structure that has allocated a given
- ils(1) List inode information
- img_cat(1) Output contents of an image file.
- img_stat(1) Display details of an image file
- istat(1) Display details of a meta-data structure (i.e. inode)
- jcat(1) Show the contents of a block in the file system journal.
- jls(1) List the contents of a file system journal
- jpeg_extract(1) jpeg_extract - jpeg extractor
- mactime(1) Create an ASCII time line of file activity
- mmcat(1) Output the contents of a partition to stdout
- mmls(1) Display the partition layout of a volume system (partition tables)
- mmstat(1) Display details about the volume system (partition tables)
- sigfind(1) Find a binary signature in a file
- sorter(1) Sort files in an image into categories based on file type
- srch_strings(1) srch_strings - display printable strings in files
- tsk_comparedir(1) tsk_comparedir - compare the contents of a directory with the contents of an image or local device.
- tsk_gettimes(1) tsk_gettimes - Collect MAC times from a disk image into a body file.
- tsk_loaddb(1) tsk_loaddb - populate a SQLite database with metadata from a disk image
- tsk_recover(1) tsk_recover - Export files from an image into a local directory
- usnjls(1) List the contents of a NTFS Update Sequence Number journal