---
name: "fiwalk"
section: "1"
platform: "linux"
package: "sleuthkit"
version: "4.12.1+dfsg-3"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/fiwalk"
---

# fiwalk(1)

print the filesystem statistics and exit

## NAME

**fiwalk** - print the filesystem statistics and exit

## SYNOPSIS

```
 fiwalk [options] iso-name
```

## DESCRIPTION

**fiwalk** is a program that processes a disk image using the SleuthKit library and outputs its results in Digital Forensics XML, the Attribute Relationship File Format (ARFF) format used by the Weka Datamining Toolkit, or an easy-to-read textual format.

This application uses SleuthKit to generate a report of all of the files and orphaned inodes found in a disk image. It can optionally compute the MD5 of any objects, save those objects into a directory, or both.

## OPTIONS

- **-c config.txt**

  read config.txt for metadata extraction tools

- **-C nn**

  only process nn files, then do a clean exit

Include/exclude parameters; may be repeated:

- **-n pattern**

  only match files for which the filename matches the pattern. Example: **-n** .jpeg **-n** .jpg will find all JPEG files. Case is ignored. Will not match orphan files.

Ways to make this program run faster:

- **-I**

  ignore NTFS system files

- **-g**

  just report the file objects - don't get the data

- **-O**

  only walk allocated files

- **-b**

  do not report byte runs if data not accessed

- **-z**

  do not calculate MD5 or SHA1 values

- **-Gnn**

  Only process the contents of files smaller than nn gigabytes (default 2). Use **-G0** to remove space restrictions.

Ways to make this program run slower:

- **-M**

  Report MD5 for each file (default on)

- **-1**

  Report SHA1 for each file (default on)

- **-f**

  Report the output of the 'file' command for each

Output *options*: **-m** = Output in SleuthKit 'Body file' format

- **-A\<file\>**

  ARFF output to \<file\>

- **-X\<file\>**

  XML output to a \<file\> (full DTD)

- **-X0**

  Write output to filename.xml

- **-Z**

  zap (erase) the output file

- **-x**

  XML output to stdout (no DTD)

- **-T\<file\>**

  Walkfile output to \<file\>

- **-a \<audit.txt\>**

  Read the scalpel audit.txt file

Misc:

- **-d**

  debug this program

- **-v**

  Enable SleuthKit verbose flag

## AUTHOR

The Sleuth Kit was written by Brian Carrier \<carrier@sleuthkit.org\>.

This manual page was written by Joao Eriberto Mota Filho \<eriberto@debian.org\> for the Debian project (but may be used by others).