fx

README

The Swiss Army Knife for examining text files. Combining the most useful functionalities from zcat, zless, grep, hexdump, head, tail, jq, wc and various cryptographic hashes into one performant standalone binary. As is this a forensic tool and not an editor, it is guaranteed, that no write actions will be made.

Install

$ go install github.com/cuhsat/fx@latest

Usage

fx [-x] [-p] [-h|t] [-n|c #] [-e PATTERN] [-j] [-J] [-o FILE] [PATH ...]

Positional arguments:

• PATH to open (default: current dir)

Mode:

• -x start in Hex mode

Print:

• -p print to console (no UI)

Limits:

• -h limit head of file by ...
• -t limit tail of file by ...
• -n # number of lines
• -c # number of bytes

Filters:

• -e PATTERN to filter

Evidence:

• -o FILE for evidence bag (default: EVIDENCE)
• -j output in JSON format
• -J output in JSON lines format

Options:

• --help show help message
• --version show version info

Examples

Examine the current dir:

fx

Examine directly from stdin:

fx -

Examine all .jsonl files in all sub dirs:

fx ./**/*.jsonl

Print all lines with John Doe of all files:

fx -p -e "John Doe"

Print the first 512 bytes to mbr in hex:

fx -x -hc 512 nist.dd > mbr

Basic Keymap

Shortcut	Action
Esc	Exit
Tab	Next file
Ctrl + l	Less mode
Ctrl + g	Grep mode
Ctrl + x	Hex mode
Ctrl + Space	Goto mode
Ctrl + s	Save evidence
Enter	Append filter
Backspace	Delete filter

---

Made with ❤ in Go