The Sleuth Kit

Let's considers the stages of the creation of a timeline for a filesystem.

The first step for creation of the timeline is building of body file.

There are three types of data to collect:

  • Existing on filesystem files, which we could list with the dir or ls command.
  • Deleted files, which are deleted but structures of them still exist. This allows for recovering the full path and other attributes of the file. However, this depends on the filesystem, as not all filesystems allow this.
  • Unallocated inodes ($Orphan files), which are file structures which do not exist anymore.

To build a bodyfile, we will use the fls tool from TSK. The fls tool allows interacting with a forensics image as with the filesystem and extracting timeline data from the ...

Get Practical Windows Forensics now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.