fls

List files in image

$ fls [disk.img]

$ fls -d [disk.img]

$ fls -r [disk.img]

$ fls [disk.img] [inode]

$ fls -p [disk.img]

fls [options] image [inode]

fls lists file and directory names from disk images. It's part of The Sleuth Kit forensics toolkit and examines filesystem structures directly without mounting.
The tool shows regular and deleted file entries, useful for data recovery and forensic analysis. It works with various filesystems including NTFS, FAT, ext, and HFS+.
fls enables examining disk images without modifying their contents, preserving forensic integrity.

IMAGE

Disk image file.

Starting inode (default: root).

Recursive listing.

Show deleted entries.

Long format output.

Show full paths.

Output in mactime format.

Partition offset.

Display help information.

Requires raw or forensic disk images. Deleted file recovery depends on filesystem state. Large images may be slow.

fls is part of The Sleuth Kit created by Brian Carrier. It evolved from earlier forensic tools and provides cross-platform filesystem analysis for digital investigations.

ils(1), icat(1), mmls(1)