indx-rs

$I30 INDX Carver

indx-rs carves $I30 from raw NTFS images by reading the MFT and INDX entries' slack space.

Installation

cargo build --features="cli" --release

Usage

Usage: indx-rs [OPTIONS] --mft <mft> --image <image> --ntfs-offset <offset> --bodyfile <name>

Options:
      --mft <mft>             NTFS $MFT path
  -i, --image <image>         RAW disk image path
  -o, --ntfs-offset <offset>  NTFS partition offset in bytes
  -s, --cluster-size <size>   Cluster size in bytes [default: 4096]
  -f, --bodyfile <name>       Bodyfile output
  -h, --help                  Print help
  -V, --version               Print version