freecalypso-sw: ffstools/Usage annotate

author	Mychaela Falconia <falcon@ivan.Harhan.ORG>
date	Sat, 31 Oct 2015 02:41:44 +0000 (2015-10-31)
parents	63cd64625597
children

rev	line source
250 3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	1 The generic tiffs utility needs to be invoked as follows:
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	2
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	3 tiffs [global-options] <imgfile> <org> <cmd> [command-args]
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	4
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	5 The first 3 non-optional arguments are the filename of the TIFFS image under
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	6 examination, the FFS organization being examined, and the operation to be
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	7 performed. The present utility is designed in the classic Unix manner in that
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	8 each invokation performs a single operation and exits, such that invokations of
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	9 tiffs (or one of the wrappers described below) may be plumbed into pipes and
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	10 the like.
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	11
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	12 The 2nd argument to tiffs after the FFS image filename describes how the TIFFS
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	13 instance under study is organized in terms of flash sectors. The syntax of
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	14 this argument is KxN, where K is the flash sector size in KiB and N is the
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	15 number of sectors occupied by the FFS. For MokoFFS images the correct
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	16 organization argument is 64x7 (7 sectors of 64 KiB each); for Pirelli's FFS
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	17 images it is 256x18 (18 sectors of 256 KiB each).
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	18
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	19 The following global options may be given before the image filename argument:
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	20
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	21 -a num
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	22
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	23 Use the specified flash block (sector) as the inode array block.
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	24
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	25 -o offset
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	26
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	27 The FFS image begins at the specified offset within the file, rather
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	28 than at the beginning. This option is useful when working with complete
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	29 device flash dumps of which FFS is only a part, starting somewhere
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	30 other than at 0.
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	31
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	32 -r ino
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	33
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	34 Use the specified inode as the root. Per Falcon's convention, TIFFS
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	35 inode numbers are always given in hex, hence this argument is
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	36 interpreted as hex without needing a 0x prefix.
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	37
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	38 The invokation syntax for mokoffs and pirffs wrappers is the same as for tiffs,
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	39 except that the FFS organization argument (64x7 or 256x18) is omitted; the
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	40 wrapper fills that argument in before passing the command to the main tiffs
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	41 program. The only other difference is that instead of the generic -o global
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	42 option, mokoffs takes a -f global option (no argument) which indicates that one
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	43 is working with a complete flash dump image, rather than just the FFS portion;
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	44 mokoffs -f gets translated into tiffs -o0x380000. (pirffs has no such option
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	45 at all because Pirelli's FFS starts at offset 0 within its respective flash
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	46 chip select.)
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	47
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	48 The next argument after the FFS organization for tiffs (or after the image
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	49 filename for mokoffs/pirffs) is the command (or operation) to be performed.
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	50 The following tiffs commands are currently available:
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	51
251 63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	52 General information commands
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	53 ============================
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	54
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	55 These commands display general or summary information about the FFS image:
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	56
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	57 tiffs <...> blkhdr
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	58
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	59 This command displays the basic information contained in the header of each
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	60 flash erase block comprising the FFS image.
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	61
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	62 tiffs <...> fsinfo
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	63
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	64 This command displays some general information about the file system.
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	65
250 3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	66 Standard listing/extraction commands
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	67 ====================================
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	68
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	69 These commands list or extract the normally-visible content of the FFS, i.e.,
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	70 the content which is visible when the FFS is "mounted" normally, and which the
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	71 FFS promises to preserve - as opposed to deleted or overwritten content.
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	72
251 63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	73 tiffs <...> ls [-v[v]] [pathname...]
250 3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	74
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	75 Tiffs ls without additional arguments yields a listing of the complete FFS
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	76 directory tree, akin to tar tv. Example output fragment:
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	77
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	78 fr 4096 /.journal
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	79 d /gsm
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	80 d /gsm/rf
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	81 d /gsm/rf/tx
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	82 f 512 /gsm/rf/tx/ramps.900
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	83 f 128 /gsm/rf/tx/levels.900
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	84 f 128 /gsm/rf/tx/calchan.900
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	85
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	86 The first character is 'f' for files or 'd' for directories. An 'r' following
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	87 immediately afterward means that the object has the read-only attribute set.
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	88 For files the listing includes the content size in bytes, and the last part is
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	89 the pathname of the object within the FFS.
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	90
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	91 With a single -v option added after ls, the output will include verbose
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	92 information as to the segmentation structure of each file. With two -v options
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	93 or with -vv, this additional output will also include the byte offset of each
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	94 data chunk, relative to the beginning of the FFS image.
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	95
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	96 Tiffs ls with a pathname argument yields information about the specified FFS
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	97 object; -v and -vv options act as already described, but are arguably more
3d88461d8284 beginning of TIFFS IVA documentation Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: diff changeset	98 useful when listing single files.
251 63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	99
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	100 tiffs <...> cat [-v\|-h] pathname
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	101
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	102 Just like the standard Unix cat(1) command, but cat'ing files from the FFS image
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	103 under study. The non-standard -h option means hex dump - it is handy because
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	104 almost all files in TI's GSM device FFS are binary, rather than ASCII.
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	105
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	106 tiffs <...> xtr dest-dir
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	107
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	108 This command extracts the complete content of the FFS into your ordinary Unix
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	109 file system. The sole argument is the local directory into which the root of
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	110 the GSM device FFS should be extracted.
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	111
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	112 Forensic analysis commands
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	113 ==========================
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	114
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	115 Unlike the "standard" listing/extraction commands which present TIFFS as a
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	116 "normal" Unix file system, using the "forensic" commands effectively requires
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	117 that the operator understands how TIFFS works, in particular, what an inode is
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	118 in TIFFS.
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	119
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	120 tiffs <...> lsino [-v[v]]
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	121
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	122 This command lists the FFS inode array from first to last; this listing order
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	123 will normally correspond to the forward chronological order of object creation.
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	124 -v and -vv options add verbosity.
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	125
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	126 '.' in the object type column means segment, '~' means a deleted object. The
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	127 lsino command only lists the inode array, and does not try to recover the
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	128 original type of deleted/overwritten objects from the journal or other clues.
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	129 The program attempts to recover the pathname of each inode, but because such
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	130 reverse mapping from inodes to pathnames is not an operation which TIFFS was
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	131 properly designed to support, and the pathname recovery algorithm in this TIFFS
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	132 IVA tool is made as generic as possible (doesn't look at the object types), the
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	133 lsino listing will occasionally include some bogus pathnames. Once again, it
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	134 is expected that the operator knows what s/he is doing when using these forensic
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	135 commands.
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	136
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	137 tiffs <...> lsino [-v[v]] [-f] ino...
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	138
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	139 This command works just like ls with an explicit pathname argument, but takes
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	140 one or more inode numbers instead. The -f option matters only if the requested
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	141 inode is in the deleted/overwritten state; it tells the lsino command to assume
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	142 that the object is/was the head inode of a file; -vf and -vvf combinations are
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	143 particularly useful.
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	144
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	145 tiffs <...> catino [-v\|-h] ino
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	146
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	147 Just like regular cat, but takes an inode number instead of a pathname. Can be
63cd64625597 ffstools/Usage write-up done Michael Spacefalcon <msokolov@ivan.Harhan.ORG> parents: 250 diff changeset	148 used to cat the old content of deleted or overwritten files.

250

3d88461d8284 beginning of TIFFS IVA documentation