Sleuthkit fsstat

fsstat image.dd

Displays the filesystem metadata of the image with fsstat: FS type, size, dates, and block structure.

Run it at the start of image analysis: fsstat tells you what filesystem it contains (NTFS, ext4, FAT...), the size, the number of blocks, the volume creation dates, and the structure metadata. It's the filesystem's ID card: without knowing the FS, you don't know which tools to use (Sleuth Kit commands vary by type). In IR, fsstat is the step before fls/icat — the confirmation that the image is what it appears to be and what structure you're going to analyze. It also detects inconsistencies (declared FS vs. actual).

Don't use it for content: fsstat gives volume metadata, not files — for the inventory, use fls. In images with multiple partitions, fsstat analyzes the FS of the indicated partition (use mmls first to see partitions). And watch out: in corrupted images or with a damaged FS, fsstat values can be misleading or the command may fail — verify the image (with mmls and integrity) before trusting the analysis. For a file question, fsstat is not the tool; it's the volume contextualization.