ffind

Find forensic artifacts in mount points or the live system.

go install go.foxforensics.dev/ffind@latest

Usage

$ ffind [-rcsuqhv] [-H CRC32|MD5|SHA1|SHA256] [-C CSV] [-Z ZIP] [MOUNT ...]

Available options:

• -H Hash algorithm
• -C CSV listing name
• -Z Zip archive name
• -r Relative paths
• -c Volume shadow copy
• -s System artifacts only
• -u User artifacts only
• -q Quiet mode
• -h Show usage
• -v Show version

Artifacts

Supported artifacts for Windows 7+ systems:

• System Active Directory
• System Registry Hives
• System Prefetch Files
• System Event Logs
• System AmCache
• User Registry Hives
• User Jump Lists
• User Browser Histories

License

Released under the MIT License.