protected override ProgramBase.StandardSwitches DefineCommandLine(CommandLineParser parser)
{
_inFiles = FileOrUriMultiParameter("disk", "Paths to the disks to inspect.", false);
parser.AddMultiParameter(_inFiles);
return(StandardSwitches.UserAndPassword);
}
protected override StandardSwitches DefineCommandLine(CommandLineParser parser)
{
_translation = new CommandLineEnumSwitch <GeometryTranslation>("t", "translation", "mode", GeometryTranslation.Auto, "Indicates the geometry adjustment to apply. Set this parameter to match the translation configured in the BIOS of the machine that will boot from the disk - auto should work in most cases for modern BIOS.");
_volumes = new CommandLineMultiParameter("volume", "Volumes to clone. The volumes should all be on the same disk.", false);
_destDisk = new CommandLineParameter("out_file", "Path to the output disk image.", false);
parser.AddSwitch(_translation);
parser.AddMultiParameter(_volumes);
parser.AddParameter(_destDisk);
return(StandardSwitches.OutputFormatAndAdapterType);
}
protected override ProgramBase.StandardSwitches DefineCommandLine(CommandLineParser parser)
{
_diskFiles = FileOrUriMultiParameter("disk", "The disks to inspect.", false);
_recoverFile = new CommandLineSwitch("r", "recover", "file_index", "Tries to recover the file at MFT index file_index from the disk.");
_showMeta = new CommandLineSwitch("M", "meta", null, "Don't hide files and directories that are part of the file system itself.");
_showZeroSize = new CommandLineSwitch("Z", "empty", null, "Don't hide files shown as zero size.");
parser.AddMultiParameter(_diskFiles);
parser.AddSwitch(_recoverFile);
parser.AddSwitch(_showMeta);
parser.AddSwitch(_showZeroSize);
return(StandardSwitches.UserAndPassword | StandardSwitches.PartitionOrVolume);
}
protected override StandardSwitches DefineCommandLine(CommandLineParser parser)
{
_diskFiles = FileOrUriMultiParameter("disk", "Paths to the disks to inspect.", false);
_showHidden = new CommandLineSwitch("H", "hidden", null, "Don't hide files and directories with the hidden attribute set in the directory listing.");
_showSystem = new CommandLineSwitch("S", "system", null, "Don't hide files and directories with the system attribute set in the directory listing.");
_showMeta = new CommandLineSwitch("M", "meta", null, "Don't hide files and directories that are part of the file system itself in the directory listing.");
parser.AddMultiParameter(_diskFiles);
parser.AddSwitch(_showHidden);
parser.AddSwitch(_showSystem);
parser.AddSwitch(_showMeta);
return(StandardSwitches.UserAndPassword | StandardSwitches.PartitionOrVolume);
}
protected override ProgramBase.StandardSwitches DefineCommandLine(CommandLineParser parser)
{
_diskFiles = FileOrUriMultiParameter("disk", "The disks to inspect.", false);
_inFilePath = new CommandLineParameter("file_path", "The path of the file to extract.", false);
_outFilePath = new CommandLineParameter("out_file", "The output file to be written.", false);
_diskType = new CommandLineSwitch("dt", "disktype", "type", "Force the type of disk - use a file extension (one of " + string.Join(", ", VirtualDisk.SupportedDiskTypes) + ")");
_hexDump = new CommandLineSwitch("hd", "hexdump", null, "Output a HexDump of the NTFS stream to the console, in addition to writing it to the output file.");
parser.AddMultiParameter(_diskFiles);
parser.AddParameter(_inFilePath);
parser.AddParameter(_outFilePath);
parser.AddSwitch(_diskType);
parser.AddSwitch(_hexDump);
return(StandardSwitches.UserAndPassword | StandardSwitches.PartitionOrVolume);
}
protected override StandardSwitches DefineCommandLine(CommandLineParser parser)
{
_inFiles = FileOrUriMultiParameter("disk", "Paths to the disks to inspect. Where a volume manager is used to span volumes across multiple virtual disks, specify all disks in the set.", false);
_showContent = new CommandLineSwitch("db", "diskbytes", null, "Includes a hexdump of all disk content in the output");
_showVolContent = new CommandLineSwitch("vb", "volbytes", null, "Includes a hexdump of all volumes content in the output");
_showFiles = new CommandLineSwitch("sf", "showfiles", null, "Includes a list of all files found in volumes");
_showBootCode = new CommandLineSwitch("bc", "bootcode", null, "Includes a hexdump of the MBR and OS boot code in the output");
_hideExtents = new CommandLineSwitch("he", "hideextents", null, "Suppresses display of the stored extents, which can be slow for large disk images");
_diskType = new CommandLineSwitch("dt", "disktype", "type", "Force the type of disk - use a file extension (one of " + string.Join(", ", VirtualDisk.SupportedDiskTypes) + ")");
parser.AddMultiParameter(_inFiles);
parser.AddSwitch(_showContent);
parser.AddSwitch(_showVolContent);
parser.AddSwitch(_showFiles);
parser.AddSwitch(_showBootCode);
parser.AddSwitch(_hideExtents);
parser.AddSwitch(_diskType);
return(StandardSwitches.UserAndPassword | StandardSwitches.FileNameEncoding);
}
