Velocidex
Windows version is unusable with actual help
Sorry, wrong tool! This article refers to winpmem!
The whole help is not ready for Windows command line version: a) help does not work with /? as expected in Windows but with --help or -h as in Linux - okay, I could survive it, but it is not very practical, if possible use all 3 help versions, b) the help runs thru without a stop at the end of each visible site. Maybe removing the free space between the options would be helpful too. c) there is no explanation how it works in Windows command line (use "/" like in Unix or "\" (backslash) like in Windows?) d) I did not find out how to call the suspect HD in Windows ("/dev/sda" or something like "disk 0") and which option has to be used to name it (-i ???) e) at -o I did not find out how the output is called at Windows (-o G:\folder1\aff4file.aff4 or -o G:/folder1/aff4file.aff4) or without .aff4 ending? f) as much as I understood it is possible to backup 2 or more HD within the same .aff4 file. The syntax for this is not clear too. Can i use -i (if this is the correct option) several times?
