1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
|
Description: Fixes formatting errors in manpages
Author: Julien Valroff <julien@debian.org>
Last-Update: 2011-06-01
--- a/man/tsk_comparedir.1
+++ b/man/tsk_comparedir.1
@@ -30,7 +30,7 @@
.IP -V
Print version
.IP "-i imgtype"
-The format of the image file (use '-i list' for supported types)
+The format of the image file (use '\-i list' for supported types)
If not given, autodetection methods are used.
.IP "-b dev_sector_size"
The size (in bytes) of the device sectors
--- a/man/tsk_gettimes.1
+++ b/man/tsk_gettimes.1
@@ -14,7 +14,7 @@
.I image
.SH DESCRIPTION
.B tsk_gettimes
-examines each of the file systems in a disk image and returns the data about them in the MACtime body format (the same as running 'fls -m' on each file system). The output of this can be used as input to mactime to make a timeline of file activity. The data is printed to STDOUT, which can then be redirected to a file.
+examines each of the file systems in a disk image and returns the data about them in the MACtime body format (the same as running 'fls \-m' on each file system). The output of this can be used as input to mactime to make a timeline of file activity. The data is printed to STDOUT, which can then be redirected to a file.
The arguments are as follows:
.IP -v
@@ -22,7 +22,7 @@
.IP -V
Print version
.IP "-i imgtype"
-The format of the image file (use '-i list' for supported types)
+The format of the image file (use '\-i list' for supported types)
If not given, autodetection methods are used.
.IP "-b dev_sector_size"
The size (in bytes) of the device sectors
--- a/man/tsk_loaddb.1
+++ b/man/tsk_loaddb.1
@@ -32,10 +32,10 @@
Don't create block data table. This table maps each block to the file that
allocated it. This option will make this program run faster.
.IP "-i imgtype"
-The format of the image file (use '-i list' for supported types)
+The format of the image file (use '\-i list' for supported types)
.IP "-b dev_sector_size"
The size (in bytes) of the device sectors
-If -i or -b are not given, autodetection methods are used.
+If \-i or \-b are not given, autodetection methods are used.
.SH EXAMPLES
To load image data from image.dd to image.dd.db:
--- a/man/tsk_recover.1
+++ b/man/tsk_recover.1
@@ -30,7 +30,7 @@
.IP -e
Recover all files (allocated and unallocated)
.IP "-i imgtype"
-The format of the image file (use '-i list' for supported types)
+The format of the image file (use '\-i list' for supported types)
If not given, autodetection methods are used.
.IP "-b dev_sector_size"
The size (in bytes) of the device sectors
@@ -40,7 +40,7 @@
If not given, will attempt to recover all volumes in image and save them
to different folders.
.IP "-d dir_inum"
-Directory inum to recover from (must also specify a specific partition using -o or there must not be a volume system)
+Directory inum to recover from (must also specify a specific partition using \-o or there must not be a volume system)
.SH EXAMPLES
To recover only unallocated files from image.dd to the recovered directory:
--- a/man/hfind.1
+++ b/man/hfind.1
@@ -72,64 +72,64 @@
sorted by. The 'md5sum' value can also be used to sort and index "home made"
databases. 'hfind' can take data in both common formats:
- MD5 (test.txt) = 76b1f4de1522c20b67acc132937cf82e
+ MD5 (test.txt) = 76b1f4de1522c20b67acc132937cf82e
and
- 76b1f4de1522c20b67acc132937cf82e test.txt
+ 76b1f4de1522c20b67acc132937cf82e test.txt
.SH EXAMPLES
To create an MD5 index file for NIST NSRL:
- # hfind \-i nsrl-md5 /usr/local/hash/nsrl/NSRLFile.txt
+ # hfind \-i nsrl-md5 /usr/local/hash/nsrl/NSRLFile.txt
To lookup a value in the NSRL:
- # hfind /usr/local/hash/nsrl/NSRLFile.txt 76b1f4de1522c20b67acc132937cf82e
+ # hfind /usr/local/hash/nsrl/NSRLFile.txt 76b1f4de1522c20b67acc132937cf82e
- 76b1f4de1522c20b67acc132937cf82e Hash Not Found
+ 76b1f4de1522c20b67acc132937cf82e Hash Not Found
You can even do both SHA-1 and MD5 if you want:
- # hfind \-i nsrl-sha1 /usr/local/hash/nsrl/NSRLFile.txt
+ # hfind \-i nsrl-sha1 /usr/local/hash/nsrl/NSRLFile.txt
- # hfind /usr/local/hash/nsrl/NSRLFile.txt
- 76b1f4de1522c20b67acc132937cf82e
- 80001A80B3F1B80076B297CEE8805AAA04E1B5BA
+ # hfind /usr/local/hash/nsrl/NSRLFile.txt
+ 76b1f4de1522c20b67acc132937cf82e
+ 80001A80B3F1B80076B297CEE8805AAA04E1B5BA
- 76b1f4de1522c20b67acc132937cf82e Hash Not Found
+ 76b1f4de1522c20b67acc132937cf82e Hash Not Found
- 80001A80B3F1B80076B297CEE8805AAA04E1B5BA thrdcore.cpp
+ 80001A80B3F1B80076B297CEE8805AAA04E1B5BA thrdcore.cpp
To make a database of critical binaries of a trusted system, use 'md5sum':
- # md5sum /bin/* /sbin/* /usr/bin/* /usr/bin/* /usr/local/bin/* /usr/local/sbin/* > system.md5
+ # md5sum /bin/* /sbin/* /usr/bin/* /usr/bin/* /usr/local/bin/* /usr/local/sbin/* > system.md5
- # hfind \-i md5sum system.md5
+ # hfind \-i md5sum system.md5
To look entries up, the following will work:
- # hfind system.md5 76b1f4de1522c20b67acc132937cf82e
+ # hfind system.md5 76b1f4de1522c20b67acc132937cf82e
- 76b1f4de1522c20b67acc132937cf82e Hash Not Found
+ 76b1f4de1522c20b67acc132937cf82e Hash Not Found
or
- # md5sum \-q /bin/* | hfind system.md5
+ # md5sum \-q /bin/* | hfind system.md5
- 928682269cd3edb1acdf9a7f7e606ff2 /bin/bash
+ 928682269cd3edb1acdf9a7f7e606ff2 /bin/bash
- <...>
+ <...>
or
- # md5sum \-q /bin/* > bin.md5
+ # md5sum \-q /bin/* > bin.md5
- # hfind \-f bin.md5 system.md5
+ # hfind \-f bin.md5 system.md5
- 928682269cd3edb1acdf9a7f7e606ff2 /bin/bash
+ 928682269cd3edb1acdf9a7f7e606ff2 /bin/bash
- <...>
+ <...>
.SH "SEE ALSO"
|
