IFind

Description

ifind finds the meta-data structure that has data_unit allocated a data unit or has a given file name. In some cases any of the structures can be unallocated and this will still find the results.

Usage

Syntax

ifind [-alvV] [-f fstype] [-i imgtype] [-b dev_sector_size] [-o imgoffset] [-d unit_addr] [-n file] [-p par_addr] [-z ZONE] image [images]

Options

        -a: find all inodes
	-d unit_addr: Find the meta data given the data unit
	-l: long format when -p is given
	-n file: Find the meta data given the file name
	-p par_addr: Find UNALLOCATED MFT entries given the parent's meta address (NTFS only)
	-i imgtype: The format of the image file (use '-i list' for supported types)
	-b dev_sector_size: The size (in bytes) of the device sectors
	-f fstype: File system type (use '-f list' for supported types)
	-o imgoffset: The offset of the file system in the image (in sectors)
	-v: Verbose output to stderr
	-V: Print version
	-z ZONE: Time zone setting when -l -p is given

Example

cyborg@cyborg:~$ ifind   -n BOOTMGR image.dd 
43
0 Comments

Leave a reply

CONTACT US

We're are building as a community and a team. Be a part of it.

Sending

©2017 Ztrela Knowledge Solutions Pvt. Ltd

Log in with your credentials

Forgot your details?