The Sleuth Kit

Let's considers the stages of the creation of a timeline for a filesystem.

The first step for creation of the timeline is building of body file.

There are three types of data to collect:

• Existing on filesystem files, which we could list with the dir or ls command.

• Deleted files, which are deleted but structures of them still exist. This allows for recovering the full path and other attributes of the file. However, this depends on the filesystem, as not all filesystems allow this.

• Unallocated inodes ($Orphan files), which are file structures which do not exist anymore.

To build a bodyfile, we will use the fls tool from TSK. The fls tool allows interacting with a forensics image as with the filesystem and extracting timeline data from the filesystem level.

This gets the value of the inode directory, processes its content, and displays the names of files in the directory (including deleted files). If the value of inode is not present, it will display the content of the root directory...