Read the NTFS MFT to do analysis. List files (default list timematched files) timematched lists files with mismatched timestamps timematched_includedeleted lists files with mismatched timestamps including deleted files deleted lists all deleted files Display information about a given file Get the specified file (by ID or using -path option) The file is read using raw disk access, no handle is opened to the file How many bytes to read from the file at a time (used for getfile) The range of bytes to read from the file. If end is not specified, the file will be read from the start until end of file (used for getfile) The number of bytes specified will be read from the file starting at "bytes" offset from the END of the file (used for getfile) Display the full path for the file (default=true, selecting this will not display the full path) Throttle the operation to decrease disk access load Select the NTFS partition (default='c') Use a full path instead of giving a record index (overrides the record index selected and partition) Only list files with timestamps after the given date Only list files with timestamps before the given date Maximum number of results to return in file listing (default 1024) Size of bucket for list results (default 0) When more bucketsize results are found in the same time bucket (hour), they are discarded Setting to 0 will disable, returning all list results Type of bucket for list results (default hour)