Computer Hacking Forensic Investigator (CHFI v10) — Question 393

As a Computer Hacking Forensics Investigator, you have been tasked with examining a suspicious.E01 disk image file using The Sleuth Kit (TSK). You need to display the metadata structure of an inode but also want to show the addresses of its disk units. Which TSK command would best serve this purpose?

Answer options

• A. istat [-B num ] [-f fstype ] [-i imgtype] [-o imgoffset] [-b dev_sector_size] [-vV] [-z zone ] [-s seconds ] image [images] inode
• B. img_stat [-i imgtype] [-b dev_sector_size] [-tvV] image [images]
• C. fsstat [-f fstype ] [-i imgtype] [-o imgoffset] [-b dev_sector_size] [-tvV] image [images]
• D. fls [-adDFIpruvV] [-m mnt ] [-z zone ] [-f fstype ] [-s seconds ] [-i imgtype ] [-o imgoffset ] [-b dev_sector_size] image [images] [ inode]

Correct answer: A

Explanation

The correct command is A, istat, which is specifically designed to display the inode's metadata structure along with the addresses of its disk units. Options B, C, and D do not provide the necessary functionality for displaying this specific information related to inodes.