FFIND(1) General Commands Manual FFIND(1)NAME
ffind - Finds the name of the file or directory using a given inode
SYNOPSIS
ffind [-aduvV] [-f fstype] [-i imgtype] [-o imgoffset] [-b dev_sector_size] image inode
DESCRIPTION
ffind finds the names of files or directories that are allocated to inode on disk image image. By default it only will only return the
first name it finds. With some file systems, this will find deleted file names.
ARGUMENTS
image [images]
One (or more if split) disk or partition images whose format is given with '-i'.
inode Integer of inode to find.
The optional arguments are:
-a Find all occurrences of inode.
-d Find deleted entries only.
-f fstype
Identify the file system type of the image. Use '-f list' to list the supported file system types. If not given, autodetection
methods are used.
-u Find undeleted entries only.
-i imgtype
Identify the type of image file, such as raw or split. Use '-i list' to list the supported types. If not given, autodetection
methods are used.
-o imgoffset
The sector offset where the file system starts in the image.
-b dev_sector_size
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or
512-bytes is assumed.
-v Verbose output to stderr.
-V Display version.
This program searches all directory entries looking for the given inode. This is useful when an inode has been identified from a disk unit
address using ifind(1).
EXAMPLE
# ffind -a image 212
SEE ALSO ifind(1)AUTHOR
Brian Carrier <carrier at sleuthkit dot org>
Send documentation updates to <doc-updates at sleuthkit dot org>
FFIND(1)
Check Out this Related Man Page
JLS(1) General Commands Manual JLS(1)NAME
jls - List the contents of a file system journal
SYNOPSIS
jls [-f fstype ] [-vV] [-i imgtype] [-o imgoffset] [-b dev_sector_size] image [images] [inode]
DESCRIPTION
jls lists the records and entries in a file system journal. If inode is given, then it will look there for a journal. Otherwise, it will
use the default location. The output lists the journal block number and a description.
ARGUMENTS -f fstype
Specify the file system type. Use '-f list' to list the supported file system types. If not given, autodetection methods are used.
-i imgtype
Identify the type of image file, such as raw or split. Use '-i list' to list the supported types. If not given, autodetection meth-
ods are used.
-o imgoffset
The sector offset where the file system starts in the image.
-b dev_sector_size
The size, in bytes, of the underlying device sectors. If not given, the value in the image format is used (if it exists) or
512-bytes is assumed.
-V Display version
-v verbose output
image [images]
One (or more if split) disk or partition images whose format is given with '-i'.
[inode]
The inode where the file system journal can be found.
EXAMPLES
jls -f linux-ext3 img.dd
AUTHOR
Brian Carrier <carrier at sleuthkit dot org>
Send documentation updates to <doc-updates at sleuthkit dot org>
JLS(1)
Hi, I know that inode for each file is unique, but is it the for the directory? So far I found different directories has the same inode nubmer when you do ls -i, could some one explain why? Thanks a lot. (9 Replies)
I have read quite a few threads here about the unix file creation date. I was interested in finding how to display it using a unix command. find did not help me so i looked at man inode. I found direction to htino.h which is described as the
structure of the inode for S51K (UNIX), HTFS, EAFS... (4 Replies)
Where does the inode table reside ?? And how can i check the inode entries ?
I want to check the entries of inode table corrosponding to the inode no. that i got from the fuser command.
fuser -uV /clocal/mqbrkrs/user/mqsiadm/sanjay
/clocal/mqbrkrs/user/mqsiadm/sanjay:
inode ... (11 Replies)
At risk of twisting the rules to nearly the point of breaking (if you think this goes too far mods, I apologise and accept that this should be deleted), I'm hoping someone might be able to cast a little light on the following problem regarding hard links to files.
... (6 Replies)
Hi Friends,
I am new to this forum.
Can any one tell me, how to access an inode using c program.
What are all the header files, functions(APIs) and libraries etc required to do that.?:confused:
Any help on this is appreciated.
Thanks in advance. (7 Replies)
1.Will there be inode number located somewhere for deleted file?
2.Will the inode value get changed if a file is moved from one directory to another? (4 Replies)
I try to understand the meaning of an inode. I wonder whether
an inode is unique (I'm pretty sure it is) and
whether it remains the same inode regardless of whatever happens to the file, dir or whatever?
I read somewhere that an inode stores info about the file, size... so changing the... (4 Replies)
How can i trace Inode structure and modify it in UNIX kernel?
We want to change the inode structure in the sense that we want to add a new field to the inode data structure. So we want to know how and where to trace inode (7 Replies)
I am having a problem where i have two directories with same name and different inode number.I want to get rid of newer one but not sure how should i? Because when i change directory i am not sure where i get in and what i am removing:wall:
root@server # ls -lia |grep us000xyz_R5
... (10 Replies)
I'm not sure this is the *best* idea but it's what occurs to me:
I have a long bibliographical list where the entries are in a variety of forms. So, there's no consistent format.
I can pretty much find the year of publication buried in each line. Everything else is a bit of a mess. So, human... (5 Replies)
Hi,
I noticed a weird behavior in extundelete way to choose the filename to which it will restore a given inode. Here is an example :
root@rescue:~# for after in '' 0 740 741 $(date -d 'now - 1 year' +%s); do rm -rf RECOVERED_FILES/; echo -e "$(date -d@$after 2> /dev/null || echo No... (4 Replies)