Difference between revisions of "Ffind"
From SleuthKitWiki
(New page: Version 2.09 Man Page NAME ffind - Find the file or directory name that is using a given inode SYNOPSIS ffind [-aduvV] [-f fstype] [-i imgtype] [-o imgoffset] image inode ...) |
(No difference)
|
Revision as of 08:12, 17 November 2007
Version 2.09 Man Page
NAME
ffind - Find the file or directory name that is using a given inode
SYNOPSIS
ffind [-aduvV] [-f fstype] [-i imgtype] [-o imgoffset] image inode
DESCRIPTION
ffind finds the names of files or directories that use inode on image.
By default it only will only return the name it finds. This will also
show the names of deleted file names in some systems such as Linux and
OpenBSD.
The arguments are as follows:
image [images]
One (or more if split) disk or partition images whose format is
given with ’-i’.
inode Integer of inode to find.
The optional arguments are:
-a Find all occurrences of inode.
-d Find deleted entries only.
-f fstype
Identify the File System type of the image. Use the -? argument
for a list of supported file system types. If not given, the
default type for the platform is used.
-u Find undeleted entries only.
-i imgtype
Identify the type of image file, such as raw or split. Raw is
the default.
-o imgoffset
The sector offset where the file system starts in the image.
Non-512 byte sectors can be specified using ’@’ (32@2048).
-v Verbose output to stderr.
-V Display version.
This program searches all directory entries looking for the given
inode. This is useful when an inode has been identified from a disk
unit address using find_inode(1).
EXAMPLE
# ffind -a image 212
SEE ALSO
dd(1), ifind(1)
HISTORY
ffind first appeared in TCTUTILs v1.0 as find_file.
AUTHOR
Brian Carrier <carrier@sleuthkit.org>
