-
Notifications
You must be signed in to change notification settings - Fork 44
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Parse MFT records based on segment numbers #665
Comments
This will also require a small change in Overall should be a pretty easy and good addition! |
@Schamper is the order in which filesystems are loaded into a target always the same? |
That should be deterministic, yes. |
@Schamper what would be the most wise way to do this by modifying the MFT plugin or by creating a new custom MFT plugin, outside of Dissect Target.
|
Nevermind forget about the last step, it should only support a single target just like the ICat plugin. |
I would like to select which MFT records the MFT plugin outputs based on segment numbers. For example,
target-query TARGET -f mft --fs 1 --segments 0-9
executes the MFT plugin to output the first ten MFT records of the first NTFS filesystem of a target.We use Dissect Target as part of an automated processing pipeline that has 15 CPU's available to execute plugins on a target using
xargs
. Of all the plugins the MFT plugin takes the longest of all plugins, this varies from a few minutes to a few hours. Because of that we would like to speed up the processing of MFT records.I don't know if this should be part of Dissect Target or that we will just use a custom MFT plugin with some BASH commands.
The text was updated successfully, but these errors were encountered: