trustedsec / tscopy

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

copy $MFT issue

chourete opened this issue · comments

As shown by the following command output, I used *:$MFT to copy all drive letters, but TSCOPY outputs to the same folder, so in the end, I only got the last copied $MFT.

D:\test> ./TScopy_x64.exe -f '*:$MFT' -o ./tscopy -i
2023-05-22 09:44:44,594 - tscopy - INFO - Copying C:$MFT to ./tscopy$MFT
2023-05-22 09:44:47,250 - tscopy - INFO - Copying D:$MFT to ./tscopy$MFT
2023-05-22 09:44:52,717 - tscopy - INFO - Copying E:$MFT to ./tscopy$MFT

2023-05-22 09:44:55,812 - tscopy - INFO - Copying F:$MFT to ./tscopy$MFT
2023-05-22 09:44:56,062 - tscopy - INFO - Job Took 11.656000137329102 seconds

D:\test> ls tscopy
Directory listing for D:\chts\tscopy -

Name Type Size (bytes) Size (MB) Last Modified Created
$MFT 32243712 30.75 2023/5/22 AM 09:44:56 2023/5/22 PM 09:42:41
mft.pickle