[sleuthkit-users] fls vs ils results

[<yve...@fc...>]

Hi everyone,

Here are 2 commands I ran with their result. Does anyone can tell me why such a difference ?

The first command :

$ fls -f hfs -i ewf -o 256 -r -F image.e01 | wc -l

591608

and the second one :

$ ils -f hfs -i ewf -e -o 256 image.e01 | wc -l

2217


Here is the result of the command fsstat :

$ fsstat -o 256 image.e01

FILE SYSTEM INFORMATION
--------------------------------------------
File System Type: HFS+
File System Version: HFS+

Volume Name: Macintosh HD
Volume Identifier: 840630f0c37165bc

Last Mounted By: Mac OS X, Journaled
Volume Unmounted Properly
Mount Count: 42789665

Creation Date: 2018-03-24 05:55:41 (CET)
Last Written Date: 2018-10-08 13:56:01 (CEST)
Last Backup Date: 0000-00-00 00:00:00 (UTC)
Last Checked Date: 2018-03-24 13:55:41 (CET)

Journal Info Block: 7447

METADATA INFORMATION
--------------------------------------------
Range: 2 - 2250393
Bootable Folder ID: 1293853 [/System/Library/CoreServices]
Startup App ID: 1764666 [/System/Library/CoreServices/boot.efi]
Startup Open Folder ID: 0
Mac OS 8/9 Blessed System Folder ID: 0
Mac OS X Blessed System Folder ID: 1293853 [/System/Library/CoreServices]
Number of files: 591603
Number of folders: 138787

CONTENT INFORMATION
--------------------------------------------
Block Range: 0 - 243980743
Allocation Block Size: 4096
Number of Free Blocks: 226403853


Thanks in advance !

Yves