ISTAT(1)						 ISTAT(1)


NAME
       istat - Display inode details

SYNOPSIS
       istat [-b num ] [-v] [-z hours ] image inode

DESCRIPTION
       istat displays the uid, gid, mode, size, link number, mod-
       ified , accessed, changed times, and  all  the  blocks  an
       inode has allocated.

       The options are as follows:

       -b     Display  the  addresses of num blocks.  Useful when
	      the inode is unallocated with size 0, but still has
	      block pointers.

       -v     Verbose output of debugging statements

       -z     Time  zone  difference  so  that the times are dis-
	      played in the time zone that the images were  taken
	      from.   For  example,  if the image is from CST and
	      being analyzed in EST, the value would be -1.

       image  Forensic partition image created by dd(1).

       inode  Inode number to display stats on


SEE ALSO
       dd(1), ils(1)

BUGS
       Currently only reads FFS on OpenBSD and Solaris and EXT2FS
       on Linux.

HISTORY
       istat first appeared in TCTUTILs v1.0.

AUTHOR
       Brian Carrier <carrier@cerias.purdue.edu>, but much of the
       code was taken from ils(1) in TCT.

User Manuals		     MAY 2001				1


