Added FullPath and Links column to the MFT example

Velocidex · Nov 30, 2023 · e57e313 · e57e313
1 parent 61d720b
commit e57e313
Showing 1 changed file with 11 additions and 1 deletion.
diff --git a/bin/mft.go b/bin/mft.go
@@ -35,6 +35,12 @@ const (
 	mft_entry_size int64 = 0x400
 )
 
+type DetailedHighlights struct {
+	*parser.MFTHighlight
+	FullPath string
+	Links    []string
+}
+
 func doMFTFromFile() {
 	reader, _ := parser.NewPagedReader(*mft_command_file_arg, 1024, 10000)
 	st, err := (*mft_command_file_arg).Stat()
@@ -78,7 +84,11 @@ func doMFTFromImage() {
 			continue
 		}
 
-		serialized, err := json.MarshalIndent(item, " ", " ")
+		serialized, err := json.MarshalIndent(DetailedHighlights{
+			MFTHighlight: item,
+			FullPath:     item.FullPath(),
+			Links:        item.Links(),
+		}, " ", " ")
 		kingpin.FatalIfError(err, "Marshal")
 
 		fmt.Println(string(serialized))