Initial import — ntdsextract2 Docker build context

Cargo-installs --locked from crates.io on rust:1.96-alpine3.21 with
build-base + linux-headers + gettext-dev (libesedb's bundled C tree
needs all three). Final image is ~26MB on alpine:3.21.

README.md

@@ -0,0 +1,45 @@
+# docker_ntdsextract2
+
+Build context for `tabledevil/ntdsextract2` — Jan Starke's Rust NTDS.DIT
+forensic analyser.
+
+Upstream: <https://codeberg.org/janstarke/ntdsextract2> (the GitHub
+mirror at <https://github.com/janstarke/ntdsextract2> is archived; same
+author, same code).
+
+## What it does
+
+Offline analysis of an extracted Active Directory database:
+
+| subcommand | output |
+|---|---|
+| `user` | account list with SID, RID, status, last logon, password timestamps |
+| `group` | groups + members |
+| `computer` | joined hosts with last-logon and OS strings |
+| `timeline` | bodyfile-format timeline (feed `mactime`) |
+| `tree` | the DIT hierarchy |
+| `entry` | dump a single entry by DN |
+| `search` | regex search over entries |
+| `types` | list the AD schema's defined types |
+
+## Getting the input
+
+`NTDS.DIT` is locked while AD is running. You need to extract it (and the
+matching `SYSTEM` registry hive) via vshadow / a forensic acquisition.
+`tabledevil/vhdi` or `tabledevil/libewf` handle E01/VHDX mounts so you can
+pull the file off cleanly.
+
+## Usage
+
+```bash
+docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 user /data/ntds.dit
+docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 timeline /data/ntds.dit > timeline.body
+```
+
+Run with no args for the in-image quick-reference banner.
+
+## Build context
+
+The image installs from crates.io (`cargo install ntdsextract2`) so the
+build always picks up Jan's latest release. To refresh the published
+image with a newer version, just rebuild — no Dockerfile edits required.