diff --git a/README.md b/README.md index d28e91b..33396ad 100644 --- a/README.md +++ b/README.md @@ -33,39 +33,35 @@ Rather than clutter up the main project with features people may not want, I wil Basic usage: ``` -Usage: analyzeMFT.py [options] filename +Usage: analyzeMFT.py -f -o [options] Options: + --version show program's version number and exit -h, --help show this help message and exit - -f FILE, --file=FILE Read MFT from FILE - -a, --anomaly Turn on anomaly detection - -l, --localtz Report times using local timezone - -d, --debug Turn on debugging output - -v, --version Report version and exit - -V, --verbose Provide additional output as the program runs (Dangerous, can produce a lot of information) - - Output Options: - -o FILE, --output=FILE - Write results to CSV FILE - -b FILE, --bodyfile=FILE - Write MAC information to bodyfile - -c FILE, --csvtimefile=FILE - Write CSV format timeline file - - Body File Options: - --bodystd Use STD_INFO timestamps for body file rather than FN - timestamps - --bodyfull Use full path name + filename rather than just - filename - - Performance Options: - --threads=THREAD_COUNT - Number of threads to use for parsing (default: 1) + -f FILE, --file=FILE MFT file to analyze + -o FILE, --output=FILE + Output file + -H, --hash Compute hashes (MD5, SHA256, SHA512, CRC32) + + Export Options: + --csv Export as CSV (default) + --json Export as JSON + --xml Export as XML + --excel Export as Excel + --body Export as body file (for mactime) + --timeline Export as TSK timeline + --l2t Export as log2timeline CSV + + Verbosity Options: + -v Increase output verbosity (can be used multiple times) + -d Increase debug output (can be used multiple times) + +Error: No input file specified. Use -f or --file to specify an MFT file. ``` ## Versioning -Current version: 3.0 +Current version: 3.0.6 ## Author diff --git a/setup.py b/setup.py index 0504c07..50a0389 100644 --- a/setup.py +++ b/setup.py @@ -33,8 +33,8 @@ "pywin32;platform_system=='Windows'", ], entry_points={ - "console_scripts": [ - "analyzeMFT=analyzeMFT.cli:main", + 'console_scripts': [ + 'analyzemft=analyzeMFT:main', ], }, ) \ No newline at end of file diff --git a/src/analyzeMFT/constants.py b/src/analyzeMFT/constants.py index 1b1e0eb..dddbefa 100644 --- a/src/analyzeMFT/constants.py +++ b/src/analyzeMFT/constants.py @@ -1,4 +1,4 @@ -VERSION = '3.0.5' +VERSION = '3.0.6.3' # File Record Flags FILE_RECORD_IN_USE = 0x0001