search

thewhiteninja / ntfstool

Forensics tool for NTFS (parser, mft, bitlocker, deleted files)
MIT License
483 stars 97 forks source link

`help extract` shows invalid command syntax #13

Closed Ark-kun closed 2 years ago

Ark-kun commented 2 years ago

Help

ntfstool.x64.exe help extract
extract command
---------------

  ntfstool.x64.exe extract [disk id] [volume id] [from] [output]

  - Extract a file specified by a path in from to output

  Extract a file:
  > ntfstool.x64.exe extract disk=0 volume=1 from="c:\windows\notepad.exe" output = "d:\notepad.exe"

  Extract SAM hive:
  > ntfstool.x64.exe extract disk=0 volume=1 --sam output = "d:\sam"

  Extract SYSTEM file:
  > ntfstool.x64.exe extract disk=0 volume=1 --system output = "d:\system"

Log:

ntfstool.x64.exe extract disk=2 volume=2 from="P:\$MFT" output = "A:\tmp\P_MFT"

[!] Invalid option: =

[!] Invalid option: A:\tmp\P_MFT
thewhiteninja commented 2 years ago

Fixed, thanks!

thewhiteninja commented 2 years ago

Spaces removed