Skip to content
  • Michael Cohen's avatar
    Support multiple $DATA attributes · 45d6165d
    Michael Cohen authored
    When files get large $DATA is split into several attributes with the
    same ID and different runlist_vcn_start. This change supports this by
    merging all these attributes into a logical ReaderAt mapped at
    different offsets.
    
    Also cleaned up the API and command line:
    1. Streams are now referenced in a similar way to TSK (mft_entry-type-id).
    2. Now commands can take either a path or mft-type-id notation.
    3. Support ADS in path semantics.
    45d6165d