# Ffind

> Advanced file finder with type detection and filesystem extraction for analyzing firmware and extracting embedded filesystems. Use when you need to analyze firmware files, identify file types, or extract ext2/3/4 or F2FS filesystems.

- **Type:** Skill
- **Install:** `agentstack add skill-brownfinesecurity-iothackbot-ffind`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [BrownFineSecurity](https://agentstack.voostack.com/s/brownfinesecurity)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [BrownFineSecurity](https://github.com/BrownFineSecurity)
- **Source:** https://github.com/BrownFineSecurity/iothackbot/tree/master/skills/ffind

## Install

```sh
agentstack add skill-brownfinesecurity-iothackbot-ffind
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Ffind - Advanced File Finder with Extraction

You are helping the user find and analyze files with advanced type detection and optional filesystem extraction capabilities using the ffind tool.

## Tool Overview

Ffind analyzes files and directories, identifies file types, and can extract filesystems (ext2/3/4, F2FS) for deeper analysis. It's designed for firmware and IoT device analysis.

## Instructions

When the user asks to analyze files, find specific file types, or extract filesystems:

1. **Understand the target**:
   - Ask what path(s) they want to analyze
   - Determine if they want to extract filesystems or just analyze
   - Ask if they want all file types or just artifact types

2. **Execute the analysis**:
   - Use the ffind command from the iothackbot bin directory
   - Basic usage: `ffind  [ ...]`
   - To extract filesystems: `ffind  -e`
   - Custom extraction directory: `ffind  -e -d /path/to/output`
   - Show all file types: `ffind  -a`
   - Verbose output: `ffind  -v`

3. **Output formats**:
   - `--format text` (default): Human-readable colored output with type summaries
   - `--format json`: Machine-readable JSON
   - `--format quiet`: Minimal output

4. **Extraction capabilities**:
   - Supports ext2/ext3/ext4 filesystems (requires e2fsprogs)
   - Supports F2FS filesystems (requires f2fs-tools)
   - Requires sudo privileges for extraction
   - Default extraction location: `/tmp/ffind_`

## Examples

Analyze a firmware file to see file types:
```bash
ffind /path/to/firmware.bin
```

Extract all filesystems from a firmware image:
```bash
sudo ffind /path/to/firmware.bin -e
```

Analyze multiple files and show all types:
```bash
ffind /path/to/file1.bin /path/to/file2.bin -a
```

Extract to a custom directory:
```bash
sudo ffind /path/to/firmware.bin -e -d /tmp/my-extraction
```

## Important Notes

- **Name collision**: The Sleuth Kit also ships a `ffind` (it finds file names for a given inode and takes a disk image plus an inode number). If `which ffind` points at `/usr/bin/ffind` or `/usr/local/bin/ffind`, the iothackbot flags below (`-e`, `-d `, `-a`, `--format`) will be misread by the wrong binary. Confirm with `ffind --help` (the iothackbot tool shows `--extract`/`--format`); if it shows `image inode` usage, invoke the iothackbot tool by its full path in the repo `bin/` directory instead.
- Extraction requires root/sudo privileges
- Requires external tools: e2fsprogs, f2fs-tools, util-linux
- Identifies "artifact" file types relevant to security analysis by default
- Use `-a` flag to see all file types including common formats

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [BrownFineSecurity](https://github.com/BrownFineSecurity)
- **Source:** [BrownFineSecurity/iothackbot](https://github.com/BrownFineSecurity/iothackbot)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-brownfinesecurity-iothackbot-ffind
- Seller: https://agentstack.voostack.com/s/brownfinesecurity
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.