Ffind - Advanced File Finder with Extraction

Tool Overview

Instructions

1. Understand the target:
   • Ask what path(s) they want to analyze
   • Determine if they want to extract filesystems or just analyze
   • Ask if they want all file types or just artifact types
2. Execute the analysis:
   • Use the ffind command from the iothackbot bin directory
   • Basic usage:

     ffind <path> [<path2> ...]

   • To extract filesystems:

     ffind <path> -e

   • Custom extraction directory:

     ffind <path> -e -d /path/to/output

   • Show all file types:

     ffind <path> -a

   • Verbose output:

     ffind <path> -v

3. Output formats:

   • --format text

     (default): Human-readable colored output with type summaries

   • --format json

     : Machine-readable JSON

   • --format quiet

     : Minimal output
4. Extraction capabilities:
   • Supports ext2/ext3/ext4 filesystems (requires e2fsprogs)
   • Supports F2FS filesystems (requires f2fs-tools)
   • Requires sudo privileges for extraction
   • Default extraction location:

     /tmp/ffind_<timestamp>

Examples

ffind /path/to/firmware.bin

sudo ffind /path/to/firmware.bin -e

ffind /path/to/file1.bin /path/to/file2.bin -a

sudo ffind /path/to/firmware.bin -e -d /tmp/my-extraction

Important Notes

• Extraction requires root/sudo privileges
• Requires external tools: e2fsprogs, f2fs-tools, util-linux
• Identifies "artifact" file types relevant to security analysis by default
• Use

  -a

  flag to see all file types including common formats