From 7d8e3da1e8932673d32997e3abb15404b4b162cc Mon Sep 17 00:00:00 2001
From: Brian Carrier <carrier@sleuthkit.org>
Date: Tue, 18 Jun 2013 14:36:10 -0400
Subject: [PATCH] Updated usage for ils to be more clear on used status
---
man/ils.1 | 6 ++----
tools/fstools/ils.cpp | 4 ++--
2 files changed, 4 insertions(+), 6 deletions(-)
diff --git a/man/ils.1 b/man/ils.1
index 1b0460c5d..c0547a60f 100644
--- a/man/ils.1
+++ b/man/ils.1
@@ -88,11 +88,9 @@ with at least one directory entry in the file system.
List only inodes without any hard links. These belong to files that no
longer exist, and to removed files that are still open or executing.
.IP \fB-z\fR
-List only inodes with zero status change time. Presumably, these
-inodes were never used.
+List only inodes that were likely to have not been used.
.IP \fB-Z\fR
-List only inodes with non-zero status change time. Presumably, these
-belong to files that still exist, or that existed in the past.
+List only inodes that were likely to be used.
.PP
The output format is in time machine format.
The output begins with a two-line header that
diff --git a/tools/fstools/ils.cpp b/tools/fstools/ils.cpp
index 8b4522496..db44c4749 100644
--- a/tools/fstools/ils.cpp
+++ b/tools/fstools/ils.cpp
@@ -48,8 +48,8 @@ usage()
tsk_fprintf(stderr, "\t-A: Unallocated inodes\n");
tsk_fprintf(stderr, "\t-l: Linked inodes\n");
tsk_fprintf(stderr, "\t-L: Unlinked inodes\n");
- tsk_fprintf(stderr, "\t-z: Unused inodes (ctime is 0)\n");
- tsk_fprintf(stderr, "\t-Z: Used inodes (ctime is not 0)\n");
+ tsk_fprintf(stderr, "\t-z: Unused inodes\n");
+ tsk_fprintf(stderr, "\t-Z: Used inodes\n");
tsk_fprintf(stderr,
"\t-i imgtype: The format of the image file (use '-i list' for supported types)\n");
tsk_fprintf(stderr,
--
GitLab