FIWALK(1)

💖 FIWALK 💖

okay bestie, welcome to fiwalk — she's a (1) manual-page girlie and she prints the filesystem statistics and then dips, that's literally her whole thing 💅

---

✨ NAME ✨

fiwalk — print the filesystem statistics and exit. short, sweet, does one job, icon behavior fr.

---

🌸 SYNOPSIS 🌸

fiwalk [options] iso-name

like… you give her an iso name and some options and she goes. that's it. that's the whole relationship 🫶

---

🦋 DESCRIPTION 🦋

so fiwalk is a program that processes a disk image using the SleuthKit library and outputs its results in Digital Forensics XML, the Attribute Relationship File Format (ARFF) format used by the Weka Datamining Toolkit, or an easy-to-read textual format. three aesthetics, all valid ✨

this application uses SleuthKit to generate a report of all of the files and orphaned inodes found in a disk image. and like, optionally? she can compute the MD5 of any objects, save those objects into a directory, or — and hear me out — both. multitasking queen 👑

---

🎀 OPTIONS 🎀

• -c config.txt — read config.txt for metadata extraction tools. she's a reader, she's a learner 📖
• -C nn — only process nn files, then do a clean exit. like leaving the party at a reasonable hour, so mature of her

---

💜 Include/exclude parameters; may be repeated:

okay so you can stack these, repeat them, whatever you need bestie:

• -n pattern — only match files for which the filename matches the pattern. example: -n .jpeg -n .jpg will find all JPEG files. Case is ignored. will not match orphan files. ngl that last part is important, don't come for her later 😭

---

🔥 Ways to make this program run faster:

• -I — ignore NTFS system files. not them. not today 💀
• -g — just report the file objects — don't get the data
• -O — only walk allocated files
• -b — do not report byte runs if data not accessed
• -z — do not calculate MD5 or SHA1 values
• -Gnn — only process the contents of files smaller than nn gigabytes (default 2). use -G0 to remove space restrictions. size queen but make it efficient 💅

---

🌸 Ways to make this program run slower:

(yes these are the ones that actually do the work, she's just being honest about the cost 🫶)

• -M — report MD5 for each file (default on)
• -1 — report SHA1 for each file (default on)
• -f — report the output of the 'file' command for each

---

🌈 Output options:

so -m = output in SleuthKit 'Body file' format. iconic format, no notes.

• -A<file> — ARFF output to <file>
• -X<file> — XML output to a <file> (full DTD)
• -X0 — write output to filename.xml
• -Z — zap (erase) the output file. she said ZAP and she meant it, that file is GONE bestie, be so careful 😭
• -x — XML output to stdout (no DTD)
• -T<file> — walkfile output to <file>
• -a <audit.txt> — read the scalpel audit.txt file

---

🧚 Misc:

• -d — debug this program. she's in her detective era 🔍
• -v — enable SleuthKit verbose flag. she will tell you EVERYTHING

---

👑 AUTHOR 👑

the Sleuth Kit was written by Brian Carrier <carrier@sleuthkit.org>.

this manual page was written by Joao Eriberto Mota Filho <eriberto@debian.org> for the Debian project (but may be used by others). shoutout to the authors, absolute legends, we stan 🫶

---

okay that's the whole page bestie, you're officially a fiwalk scholar now, no cap 💖 this was FIWALK from way back in Dec 2013, living in the FIWALK(1) section of the manual, and she still ate. go process a disk image or whatever, i'm obsessed with you 🎀✨