Skip to content
Snippets Groups Projects
Commit 7d8e3da1 authored by Brian Carrier's avatar Brian Carrier
Browse files

Updated usage for ils to be more clear on used status

parent 9ba44023
No related branches found
No related tags found
No related merge requests found
...@@ -88,11 +88,9 @@ with at least one directory entry in the file system. ...@@ -88,11 +88,9 @@ with at least one directory entry in the file system.
List only inodes without any hard links. These belong to files that no List only inodes without any hard links. These belong to files that no
longer exist, and to removed files that are still open or executing. longer exist, and to removed files that are still open or executing.
.IP \fB-z\fR .IP \fB-z\fR
List only inodes with zero status change time. Presumably, these List only inodes that were likely to have not been used.
inodes were never used.
.IP \fB-Z\fR .IP \fB-Z\fR
List only inodes with non-zero status change time. Presumably, these List only inodes that were likely to be used.
belong to files that still exist, or that existed in the past.
.PP .PP
The output format is in time machine format. The output format is in time machine format.
The output begins with a two-line header that The output begins with a two-line header that
......
...@@ -48,8 +48,8 @@ usage() ...@@ -48,8 +48,8 @@ usage()
tsk_fprintf(stderr, "\t-A: Unallocated inodes\n"); tsk_fprintf(stderr, "\t-A: Unallocated inodes\n");
tsk_fprintf(stderr, "\t-l: Linked inodes\n"); tsk_fprintf(stderr, "\t-l: Linked inodes\n");
tsk_fprintf(stderr, "\t-L: Unlinked inodes\n"); tsk_fprintf(stderr, "\t-L: Unlinked inodes\n");
tsk_fprintf(stderr, "\t-z: Unused inodes (ctime is 0)\n"); tsk_fprintf(stderr, "\t-z: Unused inodes\n");
tsk_fprintf(stderr, "\t-Z: Used inodes (ctime is not 0)\n"); tsk_fprintf(stderr, "\t-Z: Used inodes\n");
tsk_fprintf(stderr, tsk_fprintf(stderr,
"\t-i imgtype: The format of the image file (use '-i list' for supported types)\n"); "\t-i imgtype: The format of the image file (use '-i list' for supported types)\n");
tsk_fprintf(stderr, tsk_fprintf(stderr,
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment