【旧】 # mount -o loop,ro,show_files,streams_interface=windows,offset=32256 /mnt/hgfs/image.dd /mnt/windows_mount # log2timeline -z Japan -p -r -f winxp /mnt/windows_mount -w supertimeline.txt # l2t_process -b supertimeline.txt > supertime…