/usr/share/tsk/sorter/images.sort is in sleuthkit 4.2.0-3.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 | #
# images.sort
# Save Images only
# config file for Sleuth Kit sorter
#
# Category
# If the keyword is found in the 'file' output, then the data is saved
# to either the summary file or even copied if the appropriate flags are
# given
#
# category cat_name keywords
#
#
# Extension
# If the keywords are found in the 'file' output, and the file extension
# is different than then the one on the file, an alert is generated
# 'somewhere'
# ext ext1,ext2,ext3 keywords
# Images
category images image data
ext jpg,jpeg,jpe JPEG image data
ext gif GIF image data
ext tif TIFF image data
ext png PNG image data
category images bitmap data
ext bmp PC bitmap data
|