kaliwiki/tools/ffind.md
2014-04-24 09:07:38 -05:00

675 B

ffind

Notes

Help Text

usage: ffind [-aduvV] [-f fstype] [-i imgtype] [-b dev_sector_size] [-o imgoffset] image [images] inode
	-a: Find all occurrences
	-d: Find deleted entries ONLY
	-u: Find undeleted entries ONLY
	-f fstype: Image file system type (use '-f list' for supported types)
	-i imgtype: The format of the image file (use '-i list' for supported types)
	-b dev_sector_size: The size (in bytes) of the device sectors
	-o imgoffset: The offset of the file system in the image (in sectors)
	-v: Verbose output to stderr
	-V: Print version

Example Usage

[1] http://www.forensicswiki.org/wiki/The_Sleuth_Kit_How-To