Case Information
+
+
+ (Used commands:
+ date)
+
+
| Case Number: | +${CASE_NUMBER} | +
| Officer: | +${OFFICER} | +
| Date: | +${DATE} | +
Details of the image file
+
+
+ (Used commands:
+ img_stat,
+ stat and
+ openssl)
+
+
| File Name: | +${IMAGE_FILE} | +
| Image Type: | +${IMAGE_TYPE} | +
| Size of File: | +${FILE_SIZE} bytes | +
| Size of Data: | +${DATA_SIZE} bytes | +
| MD5 of File: | +${MD5} | +
| SHA1 of File: | +${SHA1} | +
Partition layout of the volume system (partition tables)
+
+
+ (Used command:
+ mmls
+ "${IMAGE_FILE}")
+
+
+ ${SCHEME}
+
+ ${OFFSET}
+
+ ${UNITS}
+
| #1) | +Slot2) | +Start3) | +End3) | +Length3) | +Description4) | +Extra5) | +
|---|
+
+ 1)
+ ---: This is used to identify an entry where TSK was not able to find a partition table.
+
+ 2)
+ ##: A two digit number is used with volume systems that have only one table and the number corresponds to the entry in the single table.
+
+ ##:##: This format is used with volume systems that have multiple tables (like DOS partitions). The first two numbers correspond to the table ID and the second set of numbers correspond to the entry in that table. 00:01 is entry 1 in table 0.
+
+ Meta: This is used to describe an entry that is created by TSK to show where metadata structures are located. Meta entries can be suppressed with flag options. These entries are not in any volume system table, but maybe helpful to the user.
+
+ -----: This is used to identify an entry that is created by TSK for unallocated space.
+
+ 3)
+ The Start, End, and Length columns describe the starting, ending and length of the volume (in sectors).
+
+ 4)
+ -----: This is used to identify an entry where TSK was not able to find a partition id.
+
+ 5)
+ -----: This is used to identify an entry where TSK was not able to find a file system.
+
+
General details of the file system in partition ${cnt}
+
+
+ (Used command:
+ fsstat
+ -o "${offset}" "${IMAGE_FILE}")
+
+
+${FSSTAT_OUTPUT}
+
+EOF
+)
+
+#-------------------------------------------------------------------------------
+# Partial template for the file metadata information
+# for the simple template engine.
+#-------------------------------------------------------------------------------
+ISTAT=$( ${BIN_CAT} <<'EOF'
+ Details of the meta-data structure of a meta-data address
+
+
+ (Used command:
+ istat
+ -o "${offset}" "${IMAGE_FILE}" "${meta_addr}")
+
+
+${istat_output}
+
+EOF
+)
+
+#-------------------------------------------------------------------------------
+# Partial template for the filesystem listing
+# for the simple template engine.
+#-------------------------------------------------------------------------------
+FLS=$( ${BIN_CAT} <<'EOF'
+ Listing of file and directory names in partition ${cnt}
+
+
+ (Used command:
+ fls
+ -o "${offset}" -r -p "${IMAGE_FILE}")
+
+
| Type1) | +deleted | +Metadata address | +Name | +Extra(s)2) | +
|---|
+
+ 1)
+ Type as saved in the file's file name structure/type as saved in the file's metadata structure
+
+ -: Unknown type,
+ r: Regular file,
+ d: Directory,
+ c: Character device,
+ b: Block device,
+ l: Symbolic link,
+ p: Named FIFO,
+ s: Shadow,
+ h: Socket,
+ w: Whiteout,
+ v: TSK Virtual file / directory (not a real directory, created by TSK for convenience)
+
+ 2)
+ Commands used for identifying and extracting images:
+ icat
+ and
+ file
+
+ -----: istat was not able to find some details of a meta-data structure.
+
+