diff --git a/README.md b/README.md index f5f2585..7ba09dd 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,6 @@ # ntfsDump Use to copy a file from an NTFS partitioned volume by reading the raw volume and parsing the NTFS structures. + +Similar to https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Invoke-NinjaCopy.ps1 + +Reference:https://www.codeproject.com/Articles/81456/An-NTFS-Parser-Lib