fx

README

The Swiss Army Knife for examining text files. Combining the most useful functionalities from zcat, zless, grep, hexdump, head, tail, jq, wc and various hashes into one performant standalone binary. As a forensic tool, no write actions are guaranteed to be made.

Usage

fx [-p] [-h | -t] [-n # | -c #] [-x | -e PATTERN] [-j | -J] [-o FILE] [PATH ... | -]

Special options:

• -p Print raw
• -h Limit head
• -t Limit tail
• -n Lines count
• -c Bytes count
• -x Hexdump mode
• -e Pattern value
• -j JSON output
• -J JSONL output
• -o Evidence file

Default options:

• --help Usage information
• --version Version number

Examples

Read all files in the current directory:

fx

Read directly from stdin:

fx -

Read Zip and GZip compressed files:

fx foo.zip bar.gz

Read all .jsonl files in all subdirectories:

fx ./**/*.jsonl

Extract all users with Dissect from foo.dd:

target-query -f users foo.dd | rdump -J | fx -

Write all lines with John Doe from all files to stdout:

fx -p -e "John Doe"

Write the first 3 lines of foo to bar:

fx -hn 3 foo > bar

Write the last 8 bytes of foo to bar in hex:

fx -tc 8 -x foo > bar

Install

make install

Keymap

Shortcut	Action
Esc	Exit
F1 / Ctrl + l	Less mode
F2 / Ctrl + g	Grep mode
F3 / Ctrl + x	Hex mode
F4 / Ctrl + Space	Goto mode
F5 / Ctrl + s	Save evidence
F6 / Ctrl + c	Copy to clipboard
F7	Show counts
F8 / Ctrl + d	Open debug log
F9 / Ctrl + e	Open evidence
F10	Show file(s) MD5
F11	Show file(s) SHA1
F12	Show file(s) SHA256
Tab	Load next file
Shift + Tab	Load prev file
Shift + Up	Scroll page up
Shift + Down	Scroll page down
Shift + Left	Scroll page left
Shift + Right	Scroll page right
Ctrl + Shift + Up	Scroll to start
Ctrl + Shift + Down	Scroll to end
Ctrl + r	Reload file
Ctrl + q	Close file
Ctrl + t	Cycle themes
Ctrl + f	Toggle file follow
Ctrl + n	Toggle line numbers
Ctrl + w	Toggle text wrap

F1 - Less Mode

Shortcut	Action
Space	Scroll page down

F2 - Grep Mode

Shortcut	Action
Enter	Append filter
Backspace	Delete filter
Alt + Up	Prev input in history
Alt + Down	Next input in history
Ctrl + v	Paste input
Any Key	Filter content

F3 - Hex Mode

Shortcut	Action
Space	Scroll page down

F4 - Goto Mode

Shortcut	Action
Enter	Goto line
Alt + Up	Prev input in history
Alt + Down	Next input in history
Ctrl + v	Paste input
Any Key	Line number

Evidence

JSON specification under spec.json.

Config

Located under ~/.fxrc.

Theme = "Default"
Follow = false
Line = false
Wrap = false

Environment

FX_THEME=Default

Themes

• Default
• Monokai
• Catppuccin-Latte
• Catppuccin-Frappe
• Catppuccin-Macchiato
• Catppuccin-Mocha
• VSCode-Light
• VSCode-Dark
• Darcula
• Nord
• Ansi16
• Matrix
• Monochrome

---

Made with ❤ in Go