SORTER(1) General Commands Manual SORTER(1) (NAME) sorter - (SYNOPSIS) sorter [-b size ] [-e] [-E] [-h] [-l] [-md5] [-s] [-sha1] [-U] [-v] [-V] [-a hash_alert ] [-c config ] [-C config ] [-d dir ] [-m mnt ] [-n nsrl_db ] [-x hash_exclude ] [-i imgtype] [-o imgoffset] [-f fstype] image [image] [meta_addr] (DESCRIPTION) sorter Perl . 'file' . <<>> . . The Sleuth Kit . . . (ARGUMENTS) . -d -l STDOUT . -d dir . -s . -l . -l STDOUT ( ). 'netcat' (Incident Response) . -d . image [images] -i . . ( '.001' ) . : -f fstype () . The Sleuth Kit . -i imgtype . The Sleuth Kit . -o imgoffset . -b size . . -c config . . . -C config . . 'share/sort' 'images.sort' . . -C . -m mnt (mount point) . . . -a hash_alert <<>> . MD5 . sorter 'hfind' The Sleuth Kit MD5 . -n nsrl_db National Software Reference Library (NSRL) NIST (). NSRL . sorter 'hfind' The Sleuth Kit MD5 . 'NSRLFile.txt' . -x hash_exclude <<>> . MD5 . sorter 'hfind' The Sleuth Kit MD5 . -e ( ). -U . 'file' 'unknown' . . . -h HTML . -md5 MD5 . . -sha1 SHA-1 . -s -d . JPG GIF 'images' . -h (thumbnails) . -v ( ). -V . [meta_addr] . . . (HIGH-LEVEL OVERVIEW OF PROCESS) sorter Perl The Sleuth Kit . . . -f . 'file' . 'file' ( 'image data') ( 'images') ( ). ( .txt) 'file' ( ASCII(.*?)text) . . 'fls' The Sleuth Kit . 'icat' . . 'alert' 'alert.txt' . NSRL 'exclude' . 'exclude' . 'file' ( ) . . ( -d dir) . -s . HTML . 'unknown' 'data' . 'data' 'file' 'unknown' 'file' . -U unknown . -s . . . . HTML . . ( '.') . ('mismatch') . . . . 'data' ( ). 'ils' . 'sorter' ( ). (CONFIGURATION FILES) . 'sorter' 'share/sorter' . 'default.sort' . . . -c . -C . . (category ext) . (whitespace) . (category) Perl . . 'file' . . : 'image data' 'images' : category images image data 'ASCII' 'text' 'text' : category text ASCII(.*?)text 'data' 'data' ( ^ $ Perl ). 'data' file . category data ^data? 'ignore' . . (ext) . . . . ASCII : ext txt,log ASCII(.*?)text ext c,cpp,h,js ASCII(.*?)text (carrier at sleuthkit dot org). (EXAMPLES) sorter : # sorter -f ntfs -d data/sorter images/hda1.dd # sorter -d data/sorter images/hda1.dd # sorter -i raw -f ntfs -o 63 -d data/sorter images/hda.dd NSRL (exclude) (alert): # sorter -f ntfs -d data/sorter -a /usr/hash/rootkit.db \ -x /usr/hash/win2k.db -n /usr/hash/nsrl/NSRLFile.txt \ images/hda1.dd 'images.sort' : # sorter -f ntfs -C /usr/local/sleuthkit/share/sort/images.sort \ -d data/sorter -h -s images/hda1.dd (REQUIREMENTS) NIST (NSRL) : (LICENSE) Common Public License cpl1.0.txt The Sleuth Kit . (AUTHOR) Brian Carrier : SORTER(1)