FFIND(1)

NAME
ffind - Find the file or directory name that is using a given inode

SYNOPSIS
ffind [-aduvV] [-f fstype] image inode

DESCRIPTION
ffind finds the names of files or directories that use inode on image. By default it only will only return the name it finds. This will also show the names of deleted file names in some systems such as Linux and OpenBSD. The image should be created using dd(1). The arguments are as follows:

image
    Partition image created by dd(1).

inode
    Integer of inode to find. The optional arguments are:

-a  Find all occurrences of inode.

-d  Find deleted entries only.

-f fstype
    Identify the File System type of the image. Use the -? argument for a list of supported file system types. If not given, the default type for the platform is used.

-u  Find undeleted entries only.

-v  Verbose output to stderr.

-V  Display version.

This program searches all directory entries looking for the given inode. This is useful when an inode has been identified from a disk unit address using find_inode(1).

EXAMPLE
# ffind -a image 212

SEE ALSO
dd(1), find_inode(1)

HISTORY
ffind first appeared in TCTUTILs v1.0 as find_file.

AUTHOR
Brian Carrier <carrier@sleuthkit.org>