Document how to work with records

[twiggler]

No description provided.

[Schamper]

Suggested change

	If no ``-w`` argument is provided, ``rdump`` writes the records to standard output in its default line-based format.
	If no ``-w`` argument is provided, ``rdump`` writes the records to standard output. If standard output is a TTY, ``rdump`` will output in its default line-based format. If standard output is a pipe (``rdump | xxd``), it will be in its default serialized format.

Or something like that.

[yunzheng]

This is actually not true anymore. We have changed this behavior in rdump as we found that people wanted to grep the line based output which otherwise you would grep on the binary serialized data.

The default of rdump is always text based if -w is not specified. If you want the serialized output (pipe it to another rdump process for example) you have to use -w -.

[Schamper]

Ah yes I remember, my bad 😄

[yunzheng]

Suggested change

	.. code-block:: console
	$ rdump <source> -w output.rec.gz
	.. code-block:: console
	$ rdump <source> -w output.rec.gz
	This will write the records to ``output.rec.gz`` in the default record stream format, compressed with gzip.

[yunzheng]

Suggested change

	When the ``-w`` argument is omitted, ``rdump`` sends records to standard output.
	The output format adapts to the destination: a human-readable, line-based format for terminals (TTYs), and a serialized format when piped to another command (e.g., ``rdump | xxd``).
	When the ``-w`` argument is omitted, ``rdump`` prints the string representation of the records to standard output, which is useful for piping to tools like ``grep`` or ``less``.
	If you want to output the record output to another ``rdump`` process you need to use ``-w -``, which will write the records in binary stream format to standard output.
	For example, you can chain ``rdump`` with common Linux command-line tools to analyze records. In this example, we extract image paths from a record source, sort them, count occurrences, and display the top 5 most common paths:
	.. code-block:: console
	$ rdump services.rec -w - | rdump -f "{imagepath}" | sort | uniq -c | sort -rn | head -n 5
	[reading from stdin]
	104 %SystemRoot%\system32\svchost.exe
	71 %SystemRoot%\System32\svchost.exe
	28 %systemroot%\system32\svchost.exe
	12 None
	3 %SystemRoot%\system32\lsass.exe

[yunzheng]

Suggested change

	You can get a full list of available adapters by running ``rdump --list-adapters``.
	You can get a full list of available adapters by running ``rdump --list-adapters``.
	Some adapters require extra dependencies, which will be shown in this output as well.