FLS

fls is a command-line utility within The Sleuth Kit, a free, open-source suite of digital forensics tools. It is used to list the files and directories contained in a forensic image or on a mounted file system, providing information about the filesystem structure that helps investigators understand where data resides and how it is organized. The tool can expose entries from allocated space and, with certain options, entries from unallocated space as well, including Deleted items in some cases.

The output of fls is a textual listing that identifies each file system entry with attributes such as its location in the filesystem, file type hints, and timestamp data. Analysts can typically pipe the results to other tools for parsing, formatting, or timeline construction. fls supports recursive listing to traverse directory trees and can be adjusted to focus on specific filesystem types or metadata categories, depending on the investigative needs and the options selected.

Context and usage: fls is a core component of The Sleuth Kit, frequently used in digital-forensics workflows and often in combination with Autopsy, a graphical frontend. It runs on multiple operating systems, including Linux, Windows, and macOS, and analyzes disk images or forensic images in standard formats. By providing a structured view of a filesystem’s contents, fls assists in evidence discovery, timeline creation, and the recovery of deleted files.

History and scope: The Sleuth Kit, including fls, was developed to support open, reproducible forensic analysis and is widely employed by law enforcement, digital forensics practitioners, and researchers.