Merge pull request #15 from thewhiteninja/dev

v1.6-dev
thewhiteninja · Mar 30, 2022 · 479de9a · 479de9a
2 parents 99c49f2 + 31701aa
commit 479de9a
Show file tree

Hide file tree

Showing 57 changed files with 2,774 additions and 815 deletions.
diff --git a/.gitignore b/.gitignore
@@ -43,3 +43,4 @@ Docs\sources_private
 /NTFS.vcxproj.user
 /Docs/sources_private
 /vcpkg_installed
+/test.bat
diff --git a/LICENSE b/LICENSE
@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2019 thewhiteninja
+Copyright (c) 2022 thewhiteninja
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

diff --git a/NTFS.vcxproj b/NTFS.vcxproj
@@ -57,11 +57,18 @@
     <ClInclude Include="Sources\Utils\buffer.h" />
     <ClInclude Include="Sources\Utils\constant_names.h" />
     <ClInclude Include="Sources\Utils\crash_handler.h" />
+    <ClInclude Include="Sources\Utils\csv_file.h" />
+    <ClInclude Include="Sources\Utils\formatted_file.h" />
     <ClInclude Include="Sources\Utils\index_details.h" />
+    <ClInclude Include="Sources\Utils\json_file.h" />
+    <ClInclude Include="Sources\Utils\path_finder.h" />
     <ClInclude Include="Sources\Utils\progress_bar.h" />
     <ClInclude Include="Sources\Utils\table.h" />
     <ClInclude Include="Sources\Utils\btree.h" />
+    <ClInclude Include="Sources\Utils\usn_rules.h" />
+    <ClInclude Include="Sources\Utils\usn_stats.h" />
     <ClInclude Include="Sources\Utils\utils.h" />
+    <ClInclude Include="Sources\Utils\zone_identifier.h" />
   </ItemGroup>
   <ItemGroup>
     <ClCompile Include="Sources\Bitlocker\bek.cpp" />
@@ -70,26 +77,28 @@
     <ClCompile Include="Sources\Bitlocker\password.cpp" />
     <ClCompile Include="Sources\Bitlocker\recovery.cpp" />
     <ClCompile Include="Sources\Commands\commands.cpp" />
-    <ClCompile Include="Sources\Commands\command_bitdecrypt.cpp" />
-    <ClCompile Include="Sources\Commands\command_bitlocker.cpp" />
-    <ClCompile Include="Sources\Commands\command_btree.cpp" />
-    <ClCompile Include="Sources\Commands\command_efs_backup.cpp" />
-    <ClCompile Include="Sources\Commands\command_efs_certificate.cpp" />
-    <ClCompile Include="Sources\Commands\command_efs_decrypt.cpp" />
-    <ClCompile Include="Sources\Commands\command_efs_key.cpp" />
-    <ClCompile Include="Sources\Commands\command_efs_masterkey.cpp" />
+    <ClCompile Include="Sources\Commands\command_bitlocker.decrypt.cpp" />
+    <ClCompile Include="Sources\Commands\command_bitlocker.info.cpp" />
+    <ClCompile Include="Sources\Commands\command_mft.btree.cpp" />
+    <ClCompile Include="Sources\Commands\command_efs.backup.cpp" />
+    <ClCompile Include="Sources\Commands\command_efs.certificate.cpp" />
+    <ClCompile Include="Sources\Commands\command_efs.decrypt.cpp" />
+    <ClCompile Include="Sources\Commands\command_efs.key.cpp" />
+    <ClCompile Include="Sources\Commands\command_efs.masterkey.cpp" />
     <ClCompile Include="Sources\Commands\command_extract.cpp" />
     <ClCompile Include="Sources\Commands\command_image.cpp" />
-    <ClCompile Include="Sources\Commands\command_logfile.cpp" />
+    <ClCompile Include="Sources\Commands\command_logfile.dump.cpp" />
+    <ClCompile Include="Sources\Commands\command_mft.dump.cpp" />
     <ClCompile Include="Sources\Commands\command_reparse.cpp" />
     <ClCompile Include="Sources\Commands\command_shadow.cpp" />
     <ClCompile Include="Sources\Commands\command_shell.cpp" />
-    <ClCompile Include="Sources\Commands\command_fve.cpp" />
-    <ClCompile Include="Sources\Commands\command_mft.cpp" />
+    <ClCompile Include="Sources\Commands\command_bitlocker.fve.cpp" />
+    <ClCompile Include="Sources\Commands\command_mft.record.cpp" />
     <ClCompile Include="Sources\Commands\command_smart.cpp" />
     <ClCompile Include="Sources\Commands\command_streams.cpp" />
     <ClCompile Include="Sources\Commands\command_undelete.cpp" />
-    <ClCompile Include="Sources\Commands\command_usn.cpp" />
+    <ClCompile Include="Sources\Commands\command_usn.analyze.cpp" />
+    <ClCompile Include="Sources\Commands\command_usn.dump.cpp" />
     <ClCompile Include="Sources\Commands\command_vbr.cpp" />
     <ClCompile Include="Sources\Commands\command_gpt.cpp" />
     <ClCompile Include="Sources\Commands\command_help.cpp" />
@@ -119,14 +128,20 @@
     <ClCompile Include="Sources\options.cpp" />
     <ClCompile Include="Sources\Utils\constant_names.cpp" />
     <ClCompile Include="Sources\Utils\crash_handler.cpp" />
+    <ClCompile Include="Sources\Utils\csv_file.cpp" />
     <ClCompile Include="Sources\Utils\index_details.cpp" />
+    <ClCompile Include="Sources\Utils\json_file.cpp" />
+    <ClCompile Include="Sources\Utils\path_finder.cpp" />
     <ClCompile Include="Sources\Utils\table.cpp" />
     <ClCompile Include="Sources\Utils\btree.cpp" />
+    <ClCompile Include="Sources\Utils\usn_rules.cpp" />
     <ClCompile Include="Sources\Utils\utils.cpp" />
+    <ClCompile Include="Sources\Utils\zone_identifier.cpp" />
   </ItemGroup>
   <ItemGroup>
     <None Include="LICENSE" />
     <None Include="README.md" />
+    <None Include="Rules\default.json" />
   </ItemGroup>
   <PropertyGroup Label="Globals">
     <VCProjectVersion>15.0</VCProjectVersion>

diff --git a/NTFS.vcxproj.filters b/NTFS.vcxproj.filters
@@ -58,6 +58,9 @@
     <Filter Include="Source Files\EFS">
       <UniqueIdentifier>{c3b20f0c-65ae-4b68-9e00-a7cd05c0b8c9}</UniqueIdentifier>
     </Filter>
+    <Filter Include="Rules">
+      <UniqueIdentifier>{b75428fc-74c9-4316-9e3f-8f3cca8bfd91}</UniqueIdentifier>
+    </Filter>
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="Sources\options.h">
@@ -189,6 +192,27 @@
     <ClInclude Include="Sources\Compression\lznt1.h">
       <Filter>Header Files\Compression</Filter>
     </ClInclude>
+    <ClInclude Include="Sources\Utils\zone_identifier.h">
+      <Filter>Header Files\Utils</Filter>
+    </ClInclude>
+    <ClInclude Include="Sources\Utils\csv_file.h">
+      <Filter>Header Files\Utils</Filter>
+    </ClInclude>
+    <ClInclude Include="Sources\Utils\formatted_file.h">
+      <Filter>Header Files\Utils</Filter>
+    </ClInclude>
+    <ClInclude Include="Sources\Utils\json_file.h">
+      <Filter>Header Files\Utils</Filter>
+    </ClInclude>
+    <ClInclude Include="Sources\Utils\usn_rules.h">
+      <Filter>Header Files\Utils</Filter>
+    </ClInclude>
+    <ClInclude Include="Sources\Utils\path_finder.h">
+      <Filter>Header Files\Utils</Filter>
+    </ClInclude>
+    <ClInclude Include="Sources\Utils\usn_stats.h">
+      <Filter>Header Files\Utils</Filter>
+    </ClInclude>
   </ItemGroup>
   <ItemGroup>
     <ClCompile Include="Sources\main.cpp">
@@ -209,7 +233,7 @@
     <ClCompile Include="Sources\Commands\command_mbr.cpp">
       <Filter>Source Files\Commands</Filter>
     </ClCompile>
-    <ClCompile Include="Sources\Commands\command_fve.cpp">
+    <ClCompile Include="Sources\Commands\command_bitlocker.fve.cpp">
       <Filter>Source Files\Commands</Filter>
     </ClCompile>
     <ClCompile Include="Sources\Utils\table.cpp">
@@ -224,25 +248,25 @@
     <ClCompile Include="Sources\Commands\command_vbr.cpp">
       <Filter>Source Files\Commands</Filter>
     </ClCompile>
-    <ClCompile Include="Sources\Commands\command_bitlocker.cpp">
+    <ClCompile Include="Sources\Commands\command_bitlocker.info.cpp">
       <Filter>Source Files\Commands</Filter>
     </ClCompile>
-    <ClCompile Include="Sources\Commands\command_mft.cpp">
+    <ClCompile Include="Sources\Commands\command_mft.record.cpp">
       <Filter>Source Files\Commands</Filter>
     </ClCompile>
-    <ClCompile Include="Sources\Commands\command_usn.cpp">
+    <ClCompile Include="Sources\Commands\command_usn.dump.cpp">
       <Filter>Source Files\Commands</Filter>
     </ClCompile>
     <ClCompile Include="Sources\Commands\command_shell.cpp">
       <Filter>Source Files\Commands</Filter>
     </ClCompile>
-    <ClCompile Include="Sources\Commands\command_logfile.cpp">
+    <ClCompile Include="Sources\Commands\command_logfile.dump.cpp">
       <Filter>Source Files\Commands</Filter>
     </ClCompile>
     <ClCompile Include="Sources\Commands\command_undelete.cpp">
       <Filter>Source Files\Commands</Filter>
     </ClCompile>
-    <ClCompile Include="Sources\Commands\command_bitdecrypt.cpp">
+    <ClCompile Include="Sources\Commands\command_bitlocker.decrypt.cpp">
       <Filter>Source Files\Commands</Filter>
     </ClCompile>
     <ClCompile Include="Sources\NTFS\ntfs_explorer.cpp">
@@ -311,16 +335,16 @@
     <ClCompile Include="Sources\Commands\command_streams.cpp">
       <Filter>Source Files\Commands</Filter>
     </ClCompile>
-    <ClCompile Include="Sources\Commands\command_efs_masterkey.cpp">
+    <ClCompile Include="Sources\Commands\command_efs.masterkey.cpp">
       <Filter>Source Files\Commands</Filter>
     </ClCompile>
     <ClCompile Include="Sources\EFS\masterkey_file.cpp">
       <Filter>Source Files\EFS</Filter>
     </ClCompile>
-    <ClCompile Include="Sources\Commands\command_btree.cpp">
+    <ClCompile Include="Sources\Commands\command_mft.btree.cpp">
       <Filter>Source Files\Commands</Filter>
     </ClCompile>
-    <ClCompile Include="Sources\Commands\command_efs_key.cpp">
+    <ClCompile Include="Sources\Commands\command_efs.key.cpp">
       <Filter>Source Files\Commands</Filter>
     </ClCompile>
     <ClCompile Include="Sources\EFS\private_key_enc.cpp">
@@ -338,16 +362,16 @@
     <ClCompile Include="Sources\EFS\certificate_file.cpp">
       <Filter>Source Files\EFS</Filter>
     </ClCompile>
-    <ClCompile Include="Sources\Commands\command_efs_backup.cpp">
+    <ClCompile Include="Sources\Commands\command_efs.backup.cpp">
       <Filter>Source Files\Commands</Filter>
     </ClCompile>
     <ClCompile Include="Sources\Commands\commands.cpp">
       <Filter>Source Files\Commands</Filter>
     </ClCompile>
-    <ClCompile Include="Sources\Commands\command_efs_certificate.cpp">
+    <ClCompile Include="Sources\Commands\command_efs.certificate.cpp">
       <Filter>Source Files\Commands</Filter>
     </ClCompile>
-    <ClCompile Include="Sources\Commands\command_efs_decrypt.cpp">
+    <ClCompile Include="Sources\Commands\command_efs.decrypt.cpp">
       <Filter>Source Files\Commands</Filter>
     </ClCompile>
     <ClCompile Include="Sources\EFS\pkcs12_archive.cpp">
@@ -368,6 +392,27 @@
     <ClCompile Include="Sources\Compression\lznt1.cpp">
       <Filter>Source Files\Compression</Filter>
     </ClCompile>
+    <ClCompile Include="Sources\Commands\command_mft.dump.cpp">
+      <Filter>Source Files\Commands</Filter>
+    </ClCompile>
+    <ClCompile Include="Sources\Utils\zone_identifier.cpp">
+      <Filter>Source Files\Utils</Filter>
+    </ClCompile>
+    <ClCompile Include="Sources\Utils\csv_file.cpp">
+      <Filter>Source Files\Utils</Filter>
+    </ClCompile>
+    <ClCompile Include="Sources\Utils\json_file.cpp">
+      <Filter>Source Files\Utils</Filter>
+    </ClCompile>
+    <ClCompile Include="Sources\Commands\command_usn.analyze.cpp">
+      <Filter>Source Files\Commands</Filter>
+    </ClCompile>
+    <ClCompile Include="Sources\Utils\usn_rules.cpp">
+      <Filter>Source Files\Utils</Filter>
+    </ClCompile>
+    <ClCompile Include="Sources\Utils\path_finder.cpp">
+      <Filter>Source Files\Utils</Filter>
+    </ClCompile>
   </ItemGroup>
   <ItemGroup>
     <None Include="README.md">
@@ -376,5 +421,8 @@
     <None Include="LICENSE">
       <Filter>Other files</Filter>
     </None>
+    <None Include="Rules\default.json">
+      <Filter>Rules</Filter>
+    </None>
   </ItemGroup>
 </Project>