# this is the default configuration file for log2timeline-sift
# this can be changed using the -c CONFIGFILE option of the tool

# the location of the TSK binaries
icat = /usr/local/bin/icat
mmls = /usr/local/bin/mmls
fls = /usr/local/bin/fls

# location to where the image file should be mounted
mount_point = /mnt/windows_mount
# location of the directory the timeline should be stored in
store_point = /cases/timeline/

# the mount command (most of the options that are used)
#	right after this command there will be the option of ",offset=" so the command here 
#	must support that
mount_cmd = "/bin/mount -o ro,loop,show_sys_files,streams_interface=windows"
# this is the original mount command that sometimes caused problems (hence the new version)
#mount_cmd = "/sbin/mount.ntfs-3g -o ro,loop,nodev,noexec,show_sys_files,streams_interface=windows"

