Agent skill · research science · aiskillstore
ffind
Advanced file finder with type detection and filesystem extraction for analyzing firmware and extracting embedded filesystems. Use when you need to analyze firmware files, identify file types, or extract ext2/3/4 or F2FS filesystems.
Why this skill is useful
Provides specific commands and extraction capabilities for analyzing firmware filesystems that the AI wouldn't reliably generate on its own.
What it needs
Requires e2fsprogs, f2fs-tools, util-linux installed locally. About 2k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Ffind - Advanced File Finder with Extraction You are helping the user find and analyze files with advanced type detection and optional filesystem extraction capabilities using the ffind tool. Tool Overview Ffind analyzes files and directories, identifies file types, and can extract filesystems (ext2/3/4, F2FS) for deeper analysis. It's designed for firmware and IoT device analysis. Instructions When the user asks to analyze files, find specific file types, or extract filesystems: 1. Understand the target: Ask what path(s) they want to analyze Determine if they want to extract filesystems or just analyze Ask if they want all file types or just artifact types 2. Execute the analysis: Use the ffind command from the iothackbot bin directory Basic usage: ffind <path> [<path2> ...] To extract filesystems: ffind <path> -e Custom extraction directory: ffind <path> -e -d /path/to/output Show all file types: ffind <path> -a Verbose output: ffind <path> -v 3. Output formats: --format text (default): Human-readable colored output with type summaries --format json: Machine-readable JSON --format quiet: Minimal output 4. Extraction capabilities: Supports ext2/ext3/ext4 filesystems (requires e2fsprogs) Supports F2FS filesystems (requires f2fs-tools) Requires sudo privileges for extraction Default extraction location: /tmp/ffind<timestamp> Examples Analyze a firmware file to see file types: Extract all filesystems from a firmware image: Analyze multiple files and show all types: Extract to a custom directory: Important Notes Name collision: The Sleuth Kit also ships a ffind (it finds file names for a given inode and takes a disk image plus an inode number). If which ffind points at /usr/bin/ffind or /usr/local/bin/ffind, the iothackbot flags below (-e, -d <dir>, -a, --format) will be misread by the wrong binary. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/ffind