Exemple #1
0
        protected override ProgramBase.StandardSwitches DefineCommandLine(CommandLineParser parser)
        {
            _inFiles = FileOrUriMultiParameter("disk", "Paths to the disks to inspect.", false);

            parser.AddMultiParameter(_inFiles);

            return StandardSwitches.UserAndPassword;
        }
Exemple #2
0
 public void AddMultiParameter(CommandLineMultiParameter multiParameter)
 {
     if (_multiParam != null)
     {
         throw new InvalidOperationException("Multi parameter already set");
     }
     _multiParam = multiParameter;
 }
 public void AddMultiParameter(CommandLineMultiParameter multiParameter)
 {
     if (_multiParam != null)
     {
         throw new InvalidOperationException("Multi parameter already set");
     }
     _multiParam = multiParameter;
 }
Exemple #4
0
        protected override StandardSwitches DefineCommandLine(CommandLineParser parser)
        {
            _diskFiles = FileOrUriMultiParameter("disk", "Paths to the disks to inspect.", false);
            _showHidden = new CommandLineSwitch("H", "hidden", null, "Don't hide files and directories with the hidden attribute set in the directory listing.");
            _showSystem = new CommandLineSwitch("S", "system", null, "Don't hide files and directories with the system attribute set in the directory listing.");
            _showMeta = new CommandLineSwitch("M", "meta", null, "Don't hide files and directories that are part of the file system itself in the directory listing.");

            parser.AddMultiParameter(_diskFiles);
            parser.AddSwitch(_showHidden);
            parser.AddSwitch(_showSystem);
            parser.AddSwitch(_showMeta);

            return StandardSwitches.UserAndPassword | StandardSwitches.PartitionOrVolume;
        }
Exemple #5
0
        protected override ProgramBase.StandardSwitches DefineCommandLine(CommandLineParser parser)
        {
            _diskFiles = FileOrUriMultiParameter("disk", "The disks to inspect.", false);
            _recoverFile = new CommandLineSwitch("r", "recover", "file_index", "Tries to recover the file at MFT index file_index from the disk.");
            _showMeta = new CommandLineSwitch("M", "meta", null, "Don't hide files and directories that are part of the file system itself.");
            _showZeroSize = new CommandLineSwitch("Z", "empty", null, "Don't hide files shown as zero size.");

            parser.AddMultiParameter(_diskFiles);
            parser.AddSwitch(_recoverFile);
            parser.AddSwitch(_showMeta);
            parser.AddSwitch(_showZeroSize);

            return StandardSwitches.UserAndPassword | StandardSwitches.PartitionOrVolume;
        }
Exemple #6
0
        protected override ProgramBase.StandardSwitches DefineCommandLine(CommandLineParser parser)
        {
            _diskFiles = FileOrUriMultiParameter("disk", "The disks to inspect.", false);
            _inFilePath = new CommandLineParameter("file_path", "The path of the file to extract.", false);
            _outFilePath = new CommandLineParameter("out_file", "The output file to be written.", false);
            _diskType = new CommandLineSwitch("dt", "disktype", "type", "Force the type of disk - use a file extension (one of " + string.Join(", ", VirtualDisk.SupportedDiskTypes) + ")");
            _hexDump = new CommandLineSwitch("hd", "hexdump", null, "Output a HexDump of the NTFS stream to the console, in addition to writing it to the output file.");

            parser.AddMultiParameter(_diskFiles);
            parser.AddParameter(_inFilePath);
            parser.AddParameter(_outFilePath);
            parser.AddSwitch(_diskType);
            parser.AddSwitch(_hexDump);

            return StandardSwitches.UserAndPassword | StandardSwitches.PartitionOrVolume;
        }
Exemple #7
0
        protected override StandardSwitches DefineCommandLine(CommandLineParser parser)
        {
            _inFiles = FileOrUriMultiParameter("disk", "Paths to the disks to inspect.  Where a volume manager is used to span volumes across multiple virtual disks, specify all disks in the set.", false);
            _showContent = new CommandLineSwitch("db", "diskbytes", null, "Includes a hexdump of all disk content in the output");
            _showVolContent = new CommandLineSwitch("vb", "volbytes", null, "Includes a hexdump of all volumes content in the output");
            _showFiles = new CommandLineSwitch("sf", "showfiles", null, "Includes a list of all files found in volumes");
            _showBootCode = new CommandLineSwitch("bc", "bootcode", null, "Includes a hexdump of the MBR and OS boot code in the output");
            _hideExtents = new CommandLineSwitch("he", "hideextents", null, "Suppresses display of the stored extents, which can be slow for large disk images");
            _diskType = new CommandLineSwitch("dt", "disktype", "type", "Force the type of disk - use a file extension (one of " + string.Join(", ", VirtualDisk.SupportedDiskTypes) + ")");

            parser.AddMultiParameter(_inFiles);
            parser.AddSwitch(_showContent);
            parser.AddSwitch(_showVolContent);
            parser.AddSwitch(_showFiles);
            parser.AddSwitch(_showBootCode);
            parser.AddSwitch(_hideExtents);
            parser.AddSwitch(_diskType);

            return StandardSwitches.UserAndPassword | StandardSwitches.FileNameEncoding;
        }
Exemple #8
0
        protected override StandardSwitches DefineCommandLine(CommandLineParser parser)
        {
            _translation = new CommandLineEnumSwitch<GeometryTranslation>("t", "translation", "mode", GeometryTranslation.Auto,"Indicates the geometry adjustment to apply.  Set this parameter to match the translation configured in the BIOS of the machine that will boot from the disk - auto should work in most cases for modern BIOS.");
            _volumes = new CommandLineMultiParameter("volume", "Volumes to clone.  The volumes should all be on the same disk.", false);
            _destDisk = new CommandLineParameter("out_file", "Path to the output disk image.", false);

            parser.AddSwitch(_translation);
            parser.AddMultiParameter(_volumes);
            parser.AddParameter(_destDisk);

            return StandardSwitches.OutputFormatAndAdapterType;
        }