This repository was archived by the owner on Jun 11, 2026. It is now read-only.

39 lines (32 loc) · 1.08 KB

ffind

Find forensic artifacts in mount points or the live system.

go install go.foxforensics.eu/ffind@latest

Usage

$ ffind [-rcsuqhv] [-H CRC32|MD5|SHA1|SHA256] [-C CSV] [-Z ZIP] [MOUNT ...]

Available options:

-H Hash algorithm
-C CSV listing name
-Z Zip archive name
-r Relative paths
-c Volume shadow copy
-s System artifacts only
-u User artifacts only
-q Quiet mode
-h Show usage
-v Show version

Artifacts

Supported artifacts for Windows 7+ systems:

License

Released under the MIT License.