diff --git a/man/ils.1 b/man/ils.1 index 1b0460c5d39d1033c6ba4dd44dd9897ca382597f..c0547a60f51409fbcfa814aafdb6fbc0881de95e 100644 --- a/man/ils.1 +++ b/man/ils.1 @@ -88,11 +88,9 @@ with at least one directory entry in the file system. List only inodes without any hard links. These belong to files that no longer exist, and to removed files that are still open or executing. .IP \fB-z\fR -List only inodes with zero status change time. Presumably, these -inodes were never used. +List only inodes that were likely to have not been used. .IP \fB-Z\fR -List only inodes with non-zero status change time. Presumably, these -belong to files that still exist, or that existed in the past. +List only inodes that were likely to be used. .PP The output format is in time machine format. The output begins with a two-line header that diff --git a/tools/fstools/ils.cpp b/tools/fstools/ils.cpp index 8b4522496efaacdafa3f21f09740d3c5f1fc736d..db44c4749115d744081c2b5bc63164095ea122f9 100644 --- a/tools/fstools/ils.cpp +++ b/tools/fstools/ils.cpp @@ -48,8 +48,8 @@ usage() tsk_fprintf(stderr, "\t-A: Unallocated inodes\n"); tsk_fprintf(stderr, "\t-l: Linked inodes\n"); tsk_fprintf(stderr, "\t-L: Unlinked inodes\n"); - tsk_fprintf(stderr, "\t-z: Unused inodes (ctime is 0)\n"); - tsk_fprintf(stderr, "\t-Z: Used inodes (ctime is not 0)\n"); + tsk_fprintf(stderr, "\t-z: Unused inodes\n"); + tsk_fprintf(stderr, "\t-Z: Used inodes\n"); tsk_fprintf(stderr, "\t-i imgtype: The format of the image file (use '-i list' for supported types)\n"); tsk_fprintf(stderr,