FFind

Description

ffind finds the names of files or directories that are allocated to inode on disk image image. By default it only will only return the first name it finds. With some file systems, this will find deleted file names.

Usage

Syntax

ffind [-aduvV] [-f fstype] [-i imgtype] [-b dev_sector_size] [-o imgoffset] image [images] inode

Options

        -a: Find all occurrences
	-d: Find deleted entries ONLY
	-u: Find undeleted entries ONLY
	-f fstype: Image file system type (use '-f list' for supported types)
	-i imgtype: The format of the image file (use '-i list' for supported types)
	-b dev_sector_size: The size (in bytes) of the device sectors
	-o imgoffset: The offset of the file system in the image (in sectors)
	-v: Verbose output to stderr
	-V: Print version

Example

cyborg@cyborg:~$ ffind  -a  image.dd   256
/-ORPHAN_FILE-/$OrphanFiles
0 Comments

Leave a reply

CONTACT US

We're are building as a community and a team. Be a part of it.

Sending

©2017 Ztrela Knowledge Solutions Pvt. Ltd

Log in with your credentials

Forgot your details?