usage: ntfs.py [-h] --input INPUT {timeline,dump} ...
ntfs.py extracts MFT records from raw files.
positional arguments:
{timeline,dump}
timeline order the mft records by timeline
dump dump mft records
optional arguments:
-h, --help show this help message and exit
--input INPUT