How to determine largest file within a .dd extention

The Sleuth Kit Help
1

Hello. I am a student learning about the Sleuth Kit. One of my assignments asked to look into a .dd file (imagedisk.dd) and asked, “Which file on diskimage.dd is largest? Explain how you determined this information.”

I have been researching this for hours with no luck. I ran a command “fls -o 128 imagedisk.dd” to view the file structure. I am able to see all files listed, but the do not give me any indication of size. I then ran a istat command to look into each file, but with several different files, it would take me a long time. I assume there is a better route.

Any suggestions would greatly be appreciated. I am running my command through a window OS.

Thank you in advance!

2

One way you could do this is to use “body file” output (see here: Body file - SleuthKitWiki). This would give you a pipe delimited output that includes the filenames and sizes. Parse the fields and sort by size for your result.

You can use fls (on a mounted image) or fiwalk to produce the body file. There may be more efficient ways, but this should work.