docs(user-manual): document sysinfo + extract-mft, clarify status drive labels#540
Merged
Conversation
…ve labels
Fill the pre-rollout gaps in the capture handbook:
* new "Step 0 — Discover volumes & probe the host": documents `uffs-mft
sysinfo` (the capture-host probe — OS class / VSS / elevation / per-drive
media, → capture_host.txt / --json) plus `drives` and `info` (previously
thin coverage);
* new "Extract a raw $MFT for third-party tools" subsection: `uffs-mft
extract-mft --input C_mft.bin --output C.mft` for analyzeMFT / MFT2CSV
interop (previously undocumented);
* expanded the CLI cheat-sheet with drives / info / sysinfo / extract-mft;
* intro note now lists extract-mft among the offline (any-platform) steps.
Also clarify `uffs --daemon status -v`: drives are labelled by letter (live
volumes by their real letter, offline .bin/.mft captures by the derived letter
tagged `(file)`), explain the `[rec/names/tri/ch/ext]` tier breakdown, and note
short view = aggregate, -v = per-drive, --json = {letter,records,tier}.
All command/flag syntax verified against the clap CLI.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pre-rollout documentation audit fixes for the capture/analysis CLI.
Gaps closed
uffs-mft sysinfo(was undocumented) → new Step 0 — Discover volumes & probe the host in the capture runbook + cheat-sheet row.uffs-mft extract-mft(was undocumented) → new "Extract a raw$MFTfor third-party tools" subsection (analyzeMFT/MFT2CSV interop) + cheat-sheet row.drives/info(thin coverage) → documented in Step 0 + cheat-sheet.daemon.mdnow explains drives are labelled by letter (live = real letter, offline.bin/.mft= derived letter tagged(file)), the[rec/names/tri/ch/ext]tier breakdown, and short vs-vvs--json.All command/flag syntax verified against the clap CLI (
info --drive,drives,sysinfo --out/--json,extract-mft --input/--output). Docs-only; balanced code fences.🤖 Generated with Claude Code