ntfsdump can be executed from the command line or incorporated into a Python script. $ ntfsdump {{query}} --output-path {{output_dir}} /path/to/imagefile.raw This ...