Added forensics section

tools/ffind.md

@@ -0,0 +1,27 @@
+# ffind
+
+Notes
+-------
+
+Help Text
+-------
+`usage: ffind [-aduvV] [-f fstype] [-i imgtype] [-b dev_sector_size] [-o imgoffset] image [images] inode
+	-a: Find all occurrences
+	-d: Find deleted entries ONLY
+	-u: Find undeleted entries ONLY
+	-f fstype: Image file system type (use '-f list' for supported types)
+	-i imgtype: The format of the image file (use '-i list' for supported types)
+	-b dev_sector_size: The size (in bytes) of the device sectors
+	-o imgoffset: The offset of the file system in the image (in sectors)
+	-v: Verbose output to stderr
+	-V: Print version
+``
+
+```
+
+Example Usage
+-------
+
+Links
+-------
+[1] http://www.forensicswiki.org/wiki/The_Sleuth_Kit_How-To