#!/bin/sh
# Banner on bare run; pass-through to ntdsextract2 otherwise.
if [ $# -eq 0 ]; then
    cat >&2 <<'EOF'
============================================================
 ntdsextract2 — Active Directory database analyser (Jan Starke)
------------------------------------------------------------
 Mount your NTDS.DIT at /data, then pick a subcommand:

   docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 \
       user /data/ntds.dit                       # account list
   docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 \
       group /data/ntds.dit                      # group membership
   docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 \
       computer /data/ntds.dit                   # joined hosts
   docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 \
       timeline /data/ntds.dit > timeline.body   # bodyfile for mactime
   docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 \
       tree /data/ntds.dit                       # DIT hierarchy
   docker run --rm -v /evidence:/data:ro tabledevil/ntdsextract2 \
       search '<regex>' /data/ntds.dit           # entry search

 NTDS.DIT files are normally locked while AD runs — extract with
 vshadow / volume shadow copy first; ntdsextract2 reads the offline
 copy directly.
============================================================
EOF
    ntdsextract2 --help 2>&1 | head -20 >&2
    exit 64
fi
exec ntdsextract2 "$@"