Sleuthkit mmls

mmls image.dd

Lists the partitions of a disk image with mmls, the volume map before analyzing each partition.

Run it when you receive a disk image: mmls shows the partition table — the type (MBR/GPT), the offset and size of each partition, and unallocated areas. It's the disk map: without it you don't know where each partition starts (Sleuth Kit commands analyze it with the -o offset). In IR, mmls is the step before fsstat and fls — and in hiding cases, unallocated partitions or anomalous tables (a hidden partition at the end of the disk) are findings in themselves.

Don't use it for content: mmls gives the map, not the files — the analysis of each partition comes later with fsstat/fls and the offset. In full disk images (with unallocated space), deleted partitions may not appear in the current table (the entry was overwritten) — for recovery, use partition carving tools. And watch out: the offset mmls shows is the critical data — using it wrong in fls/icat (incorrect offset) produces results from the wrong partition or garbage. In single-partition images (extracted), mmls may show nothing useful — the image is already the partition.