Initial import — ntdsextract2 Docker build context

Cargo-installs --locked from crates.io on rust:1.96-alpine3.21 with
build-base + linux-headers + gettext-dev (libesedb's bundled C tree
needs all three). Final image is ~26MB on alpine:3.21.

start.sh

@@ -0,0 +1,31 @@
+#!/bin/sh
+# Banner on bare run; pass-through to ntdsextract2 otherwise.
+if [ $# -eq 0 ]; then
+    cat >&2 <<'EOF'
+============================================================
+ ntdsextract2 — Active Directory database analyser (Jan Starke)
+------------------------------------------------------------
+ Mount your NTDS.DIT at /data, then pick a subcommand:
+
+   docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 \
+       user /data/ntds.dit                       # account list
+   docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 \
+       group /data/ntds.dit                      # group membership
+   docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 \
+       computer /data/ntds.dit                   # joined hosts
+   docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 \
+       timeline /data/ntds.dit > timeline.body   # bodyfile for mactime
+   docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 \
+       tree /data/ntds.dit                       # DIT hierarchy
+   docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 \
+       search '<regex>' /data/ntds.dit           # entry search
+
+ NTDS.DIT files are normally locked while AD runs — extract with
+ vshadow / volume shadow copy first; ntdsextract2 reads the offline
+ copy directly.
+============================================================
+EOF
+    ntdsextract2 --help 2>&1 | head -20 >&2
+    exit 64
+fi
+exec ntdsextract2 "$@"