Sleuth Kit Praktische Übungen: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
| Zeile 15: | Zeile 15: | ||
</pre> | </pre> | ||
=Anzeigen der | =Anzeigen der EXT4 Partion= | ||
fsstat -o 5468160 debian1.dd | more | |||
<pre> | <pre> | ||
FILE SYSTEM INFORMATION | FILE SYSTEM INFORMATION | ||
-------------------------------------------- | -------------------------------------------- | ||
File System Type: | File System Type: Ext4 | ||
Volume Name: | |||
Volume ID: 3cb5534c0a99fc9e6d463987f2410776 | |||
Last Written at: 2024-08-05 13:18:33 (EDT) | |||
Last Checked at: 2022-12-03 04:04:37 (EST) | |||
Last Mounted at: 2024-08-05 13:18:34 (EDT) | |||
Unmounted properly | |||
Last mounted on: / | |||
Source OS: Linux | |||
Dynamic Structure | |||
Compat Features: Journal, Ext Attributes, Resize Inode, Dir Index | |||
InCompat Features: Filetype, Needs Recovery, Extents, 64bit, Flexible Block Groups, | |||
Read Only Compat Features: Sparse Super, Large File, Huge File, Extra Inode Size | |||
Journal ID: 00 | |||
Journal Inode: 8 | |||
METADATA INFORMATION | METADATA INFORMATION | ||
-------------------------------------------- | -------------------------------------------- | ||
Range: | Inode Range: 1 - 1468801 | ||
Root Directory: 2 | Root Directory: 2 | ||
Free Inodes: 1310126 | |||
Inode Size: 256 | |||
Orphan Inodes: 1057216, 1057065, 1056868, 1056867, 1057017, 1056900, 1057032, | |||
CONTENT INFORMATION | CONTENT INFORMATION | ||
-------------------------------------------- | -------------------------------------------- | ||
Block Groups Per Flex Group: 16 | |||
Block Range: 0 - 5869823 | |||
Block Size: 4096 | |||
Free Blocks: 4447898 | |||
BLOCK GROUP INFORMATION | |||
-------------------------------------------- | -------------------------------------------- | ||
Number of Block Groups: 180 | |||
Inodes per group: 8160 | |||
Blocks per group: 32768 | |||
</pre> | </pre> | ||
Version vom 5. August 2024, 19:49 Uhr
Anzeigen der Partition Tabelle
- mmls debian1.dd
DOS Partition Table
Offset Sector: 0
Units are in 512-byte sectors
Slot Start End Length Description
000: Meta 0000000000 0000000000 0000000001 Primary Table (#0)
001: ------- 0000000000 0000002047 0000002048 Unallocated
002: 000:000 0000002048 0005468159 0005466112 Linux Swap / Solaris x86 (0x82)
003: 000:001 0005468160 0052426751 0046958592 Linux (0x83)
004: ------- 0052426752 0052428799 0000002048 Unallocated
Anzeigen der EXT4 Partion
fsstat -o 5468160 debian1.dd | more
FILE SYSTEM INFORMATION -------------------------------------------- File System Type: Ext4 Volume Name: Volume ID: 3cb5534c0a99fc9e6d463987f2410776 Last Written at: 2024-08-05 13:18:33 (EDT) Last Checked at: 2022-12-03 04:04:37 (EST) Last Mounted at: 2024-08-05 13:18:34 (EDT) Unmounted properly Last mounted on: / Source OS: Linux Dynamic Structure Compat Features: Journal, Ext Attributes, Resize Inode, Dir Index InCompat Features: Filetype, Needs Recovery, Extents, 64bit, Flexible Block Groups, Read Only Compat Features: Sparse Super, Large File, Huge File, Extra Inode Size Journal ID: 00 Journal Inode: 8 METADATA INFORMATION -------------------------------------------- Inode Range: 1 - 1468801 Root Directory: 2 Free Inodes: 1310126 Inode Size: 256 Orphan Inodes: 1057216, 1057065, 1056868, 1056867, 1057017, 1056900, 1057032, CONTENT INFORMATION -------------------------------------------- Block Groups Per Flex Group: 16 Block Range: 0 - 5869823 Block Size: 4096 Free Blocks: 4447898 BLOCK GROUP INFORMATION -------------------------------------------- Number of Block Groups: 180 Inodes per group: 8160 Blocks per group: 32768