FFIND(1)

💖 FFIND(1) — the ffind page, bestie 💖

okay so we're in the General Commands Manual, section 1, and the star of the show is ffind. she finds names. that's her whole thing. let's get into it 🦋

✨ NAME ✨

ffind — Finds the name of the file or directory using a given inode

🎀 SYNOPSIS 🎀

ffind [-aduvV] [-f fstype] [-i imgtype] [-o imgoffset] [-b dev_sector_size] image [images] inode

🌸 DESCRIPTION 🌸

ffind finds the names of files or directories that are allocated to inode on disk image image. like, you hand her an inode number and she goes "oh that's literally this file, here's its name 💅".

By default she only will only return the first name she finds. one and done. no scrolling.

And with some file systems? she'll even find deleted file names. ghost names. iconic behavior honestly 👻

💅 ARGUMENTS 💅

• -a — Find all occurrences of inode. not just the first one, girlie wants the whole list 🔥
• -d — Find deleted entries only. just the ghosts 🙈
• -f fstype — Identify the file system type of the image. Use -f list to list the supported file system types. If not given, autodetection methods are used. (yes bestie, she can usually figure it out herself, she's smart like that ✨)
• -u — Find undeleted entries only. the living ones only, no ghosts allowed 💀
• -i imgtype — Identify the type of image file, such as raw. Use -i list to list the supported types. If not given, autodetection methods are used.
• -o imgoffset — The sector offset where the file system starts in the image. like, where does the actual filesystem begin, bc it's not always at the very top 🎯
• -b dev_sector_size — The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or 512-bytes is assumed. so default energy is 512 bytes, no cap.
• -v — Verbose output to stderr. she'll yap (affectionately) about what she's doing.
• -V — Display version. vibe check on which build you're running 🫶
• image [images] — The disk or partition image to read, whose format is given with -i. Multiple image file names can be given if the image is split into multiple segments. If only one image file is given, and its name is the first in a sequence (e.g., as indicated by ending in .001), subsequent image segments will be included automatically. so if you've got a split image, she'll chase down the rest of the segments herself, main character energy fr fr 👑
• inode — Integer of inode to find. just the number. that's it. that's the whole ask.

This program searches all directory entries looking for the given inode. This is useful when an inode has been identified from a disk unit address using ifind(1). so like: ifind gives you the inode, ffind gives you the name. dynamic duo 🌈

⭐ EXAMPLE ⭐

# ffind -a image 212

🧚 SEE ALSO 🧚

ifind(1)

👑 AUTHOR 👑

Brian Carrier <carrier at sleuthkit dot org>

Send documentation updates to <doc-updates at sleuthkit dot org>

and that's the whole page, bestie 🎀 she's ffind(1) from the General Commands Manual — go find some filenames, you've got this 💖✨