SIGFIND(1)

📦 version 4.15.0, in alpine 3.24, arch rolling, debian bookworm, debian trixie, epel 10, epel 9, fedora 43, fedora 44, nixos 26.05, nixpkgs unstable, opensuse-leap 16.0, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

SIGFIND(1) 💅

okay bestie, gather round, because this one is a General Commands Manual entry and it is genuinely so useful. it's called sigfind and it is about to become your new obsession. 🦋

✨ NAME ✨

sigfind — find a binary signature in a file 🔍

🌸 SYNOPSIS 🌸

sigfind [-b bsize ] [-o offset ] [-t template ] [-lV] [ hex_signature ]
file

💖 DESCRIPTION 💖

so like, sigfind literally searches through a file and looks for the hex_signature at a given offset. that's it, that's the whole vibe. no cap.

and why would you care? because this is how you go hunting for lost boot sectors, superblocks, and partition tables. it's giving digital archaeology. it's giving main character energy in a hex editor. 🫶

🎀 ARGUMENTS 🎀

  • -b bsize — tell it the block size to search in. default is 512, and bestie listen, the value must be a multiple of 512. it's not a suggestion, it's the rules. 💀
  • -o offset — the offset inside a block where the signature has to exist. default is 0.
  • -t template — name a template that already defines the signature value and the offset for you. run it with no options at all to get the list of supported templates, iykyk. 📋
  • -l — the signature is stored in little-endian ordering, so it has to be reversed. yes, really. flip it. 🔄
  • -V — display version. that's it. she's simple like that. ✨
  • [hex_signature] — the actual binary signature you're hunting for, and it must be given in hexadecimal format. and heads up: this argument has to exist if you're not using -t. one of the two, bestie. you can't have neither. 🙈
  • file — any raw data. literally any raw data. 🍓

🔥 EXAMPLES 🔥

okay these are the moments:

sigfind -o 510 -l AA55 disk.dd
sigfind -t fat disk.dd

see? iconic. effortless. slay. 👑

💜 AUTHOR 💜

Brian Carrier <carrier at sleuthkit dot org> 🫡

send documentation updates to <doc-updates at sleuthkit dot org> — she reads them, fr fr.

and that's the whole page, bestie. sigfind from the General Commands Manual, in all her glory. go find some lost boot sectors, you absolute legend. 🎀💖✨

📦 where this page comes from