diff --git a/README.md b/README.md index 5919a50..333d464 100644 --- a/README.md +++ b/README.md @@ -11,33 +11,48 @@ Usage information type: MFTExtractor -h -MFT string absolute path to the MFT file (default "MFT file") + -attributes string show attributes + -entry int select a particular MFT entry (default -1) + -export export files + -fileName string show the name of the filename attribute of each MFT record choices: Any, Win32, Dos + -filesize show file size of a record holding a file + -fromEntry int select entry to start parsing + -index show index structures + -partitionNumber int select partition number (default -1) + -physicalDrive int select disk drive number for extraction of non resident files (default -1) + -resident check whether entry is resident + -runlist show runlist of MFT record attributes + -structure reconstrut entries tree + -timestamps show all timestamps + -toEntry int select entry to end parsing (default 4294967295) + -vcns show the vncs of non resident attributes