Merge branch 'main' of github.com:kero99/mftmactime into main

README.md

@@ -14,12 +14,18 @@ mftmactime.py -f /mnt/comp001/\\$MFT -o comp001_fstl.csv -n
 
 ![image](https://user-images.githubusercontent.com/143736/183637088-0089c8c4-ef23-46e1-bbd5-8321422108cb.png)
 
-#Example with dump resident files
+# Example with dump resident files
 mftmactime -f MFT -o test.csv -n -r recovery_output
 
 ![Screenshot at 2022-09-07 11-29-48](https://user-images.githubusercontent.com/143736/188844076-9eefc9b7-9801-4c23-a0df-0ef794b92dc1.png)
 
-#Example of inode entries with USN Journal and MFT mixed data
+# Example of inode entries with USN Journal and MFT mixed data
 
 ![image](https://user-images.githubusercontent.com/143736/191730418-ba1f5a8d-2ff0-4e88-aa30-236c5169e580.png)
 
+# Example of dump and process from RAW Evidence
+mftmactime -n -f ../evidence/Testing/test-img.dd -u ../evidence/Testing/test-img.dd -o ./filesystem_tln.csv -d dump -r resindents
+
+![image](https://user-images.githubusercontent.com/143736/191998130-097e69ea-80dc-4684-80ba-d4dfbe861452.png)
+
+