IFIND(1)

✨ IFIND(1) ✨

okay so bestie, we're in the General Commands Manual, section 1, and the command is ifind — she's giving forensic detective energy and honestly? iconic. 👑

💖 NAME 💖

ifind — find the meta-data structure that has allocated a given disk unit or file name.

like. you point at a thing on disk, and she tells you who owns it. main character behaviour fr fr. 🕵️♀️✨

🌸 SYNOPSIS 🌸

ifind [-avVl] [-f fstype] [-d data_unit] [-n file] [-p par_inode] [-z ZONE] [-i imgtype] [-o imgoffset] [-b dev_sector_size] image [images]

🦋 DESCRIPTION 🦋

ifind finds the meta-data structure that has data_unit allocated a data unit, or has a given file name. 💅

and here's the cute part: in some cases any of the structures can be unallocated and she will still find the results. the way she just. keeps working. obsessed. 😭💖

🎀 ARGUMENTS 🎀

There are several required and optional arguments. and heads up bestie, the image file names must be specified each time:

• image [images] — the disk or partition image to read, whose format is given with -i. you can hand her multiple image file names if the image is split into multiple segments. and get this: if you only give one image file and its name is the first in a sequence (e.g., as indicated by ending in '.001'), the subsequent image segments will be included automatically. no cap, she just does it. 🫶

You must also specify what you are looking for, and include one of the following:

• -d data_unit — finds the meta data structure that has allocated a given data unit (block, cluster, etc.)
• -n file — finds the meta data structure that is pointed to by the given file name.
• -p par_inode — finds the unallocated MFT entries in an NTFS image that have the given inode as the parent. can be used with '-l and -z'. 👑

There are also several optional arguments:

• -a — find all meta-data structures (only works when looking with a data_unit). lowkey specific but she ate.
• -f fstype — specify the file system type. use '-f list' to list the supported file system types. if not given, autodetection methods are used.
• -l — list the details of each file found with '-p', like 'fls -l'.
• -i imgtype — identify the type of image file, such as raw. use '-i list' to list the supported types. if not given, autodetection methods are used.
• -o imgoffset — the sector offset where the file system starts in the image.
• -b dev_sector_size — the size, in bytes, of the underlying device sectors. if not given, the value in the image format is used (if it exists) or 512-bytes is assumed.
• -v — verbose output to stderr.
• -V — display version.
• -z ZONE — if '-p -l' were given, this will set the timezone for the correct times. 🕰️✨

🌈 EXAMPLES 🌈

# ifind -f fat -d 456 fat-img.dd

# ifind -f linux-ext2 -n "/etc/" linux-img.dd

# ifind -f ntfs -p 5 -l -z EST5EDT ntfs-img.dd

💜 AUTHOR 💜

Brian Carrier <carrier at sleuthkit dot org>

Send documentation updates to <doc-updates at sleuthkit dot org>

and that's the whole page bestie 💅 this was section 1 of the General Commands Manual, brought to you by the <pink>ifind</pink> girlies — go find those meta-data structures, you've got this 🦋💖✨