thewhiteninja / ntfstool

Forensics tool for NTFS (parser, mft, bitlocker, deleted files)
MIT License
483 stars 97 forks source link

mft.record does not work without inode despite featured in help #12

Closed Ark-kun closed 2 years ago

Ark-kun commented 2 years ago

Log:

ntfstool.x64.exe mft.record disk=2 volume=2
[!] Missing inode option. Unable to find file record.

Help:

ntfstool.x64.exe help mft
mft.record command
------------------

  ntfstool.x64.exe mft.record [disk id] [volume id] (inode/from)

  - Display MFT file record information and detailed attributes for selected disk, volume and inode/path

  Display MFT file record for disk 0, volume 2:
  > ntfstool.x64.exe mft.record disk=0 volume=2

  Display MFT file record for disk 0, volume 2 and inode 5:
  > ntfstool.x64.exe mft.record disk=0 volume=2 inode=5

  Display MFT File record for disk 0, volume 2 and file "c:\file.bin":
  > ntfstool.x64.exe mft.record disk=0 volume=2 from="c:\file.bin"
thewhiteninja commented 2 years ago

Fixed! Without inode or from options, inode 0 will be displayed. I will not put it in the help as the it should be used with the options.