sector = BootSector(image_name=args.image,
offset_sectors=args.offset_sectors,
offset_bytes=args.offset_bytes,
sector_size=args.sector_size)
mft = MFT(image_name=args.image, boot_sector=sector)
# Export
if args.action == 'export':
# Parsing
if args.inums == 'all':
mft.parse_all()
range = None
else:
range = InumRange(args.inums)
mft.parse_inums(inum_range=range)
# Exporting
if args.export_type == 'parsed':
mft.export_parsed(inum_range=range, export_file=args.export_file)
elif args.export_type == 'csv':
mft.export_csv(inum_range=range, export_file=args.export_file)
elif args.export_type == 'raw':
mft.export_raw(inum_range=range, export_file=args.export_file)
# Extract data
if args.action == 'extractdata':
mft.parse_inum(args.inum)
mft.extract_data(inum=args.inum,
output_file=args.output_file,
stream=args.data_stream)
offset_sectors=args.offset_sectors,
offset_bytes=args.offset_bytes,
sector_size=args.sector_size)
mft = MFT(image_name=args.image, boot_sector=sector)
# Export
if args.action == 'export':
# Parsing
if args.inums == 'all':
mft.parse_all()
range = None
else:
range = InumRange(args.inums)
mft.parse_inums(inum_range=range)
# Exporting
if args.export_type == 'parsed':
mft.export_parsed(inum_range=range, export_file=args.export_file)
elif args.export_type == 'csv':
mft.export_csv(inum_range=range, export_file=args.export_file)
elif args.export_type == 'raw':
mft.export_raw(inum_range=range, export_file=args.export_file)
# Extract data
if args.action == 'extractdata':
mft.parse_inum(args.inum)
mft.extract_data(inum=args.inum, output_file=args.output_file, stream=args.data_stream)
# Statistics
