# ffind

Notes
-------

Help Text
-------
`usage: ffind [-aduvV] [-f fstype] [-i imgtype] [-b dev_sector_size] [-o imgoffset] image [images] inode
	-a: Find all occurrences
	-d: Find deleted entries ONLY
	-u: Find undeleted entries ONLY
	-f fstype: Image file system type (use '-f list' for supported types)
	-i imgtype: The format of the image file (use '-i list' for supported types)
	-b dev_sector_size: The size (in bytes) of the device sectors
	-o imgoffset: The offset of the file system in the image (in sectors)
	-v: Verbose output to stderr
	-V: Print version
``

```

Example Usage
-------

Links
-------
[1] http://www.forensicswiki.org/wiki/The_Sleuth_Kit_How-To