Recommended Improvement: Add option to pull $MFT from all volumes
CyberKaizen opened this issue · comments
Running something like : tscopy_x64 -r -o C:\Collection\TScopy\MFT -f *:$MFT
Currently it isn't possible if the user wanted to copy a $MFT file from all volumes on the system.
Supporting some kind of option or wildcard to check the root of all volumes and copy it down would help when running TSCopy in mass and you don't know the specific drive letters on the system.
I will look into the wildcard for the volume. But for now, I do it with a wrapper script that gets the volume and drive letters like this:
def get_local_drives():
"""Returns a list containing letters from local drives"""
drive_list = win32api.GetLogicalDriveStrings()
drive_list = drive_list.split("\x00")[0:-1] # the last element is ""
list_local_drives = []
for letter in drive_list:
if win32file.GetDriveType(letter) == win32file.DRIVE_FIXED:
list_local_drives.append(letter)
return list_local_drives
code has been added to support wildcard drive letters. Only works for local or fixed drives.