EvtxCarv

2015.02.04 09:17 from 분류없음

EvtxCarv

by Chanung Pak, Jaeman Park, HyeonGyu Jang


EvtxCarv is a tool for fragmented Evtx files forensics.


Supported platforms


  • Windows (VS 2010) C++

Usage

Execute EvtxCarv to analyze an image file

EvtxCarv.exe (-r|-c) 'target image path' 'output path'
Options
    --record   (-r)    : Recover by record
    --complete (-c)    : Recover by chunk

Examples of usage

EvtxCarv.exe -c c:\\image.raw c:\\output\\
EvtxCarv.exe -r image.raw output

License

DFRC@KU

Feedback

Please submit feedback via the EvtxCarv tracker

Author: Chanung Pak (kkoha@msn.com)


Download

https://github.com/kkoha/EvtxCarv/

Posted by kkoha 트랙백 0 : 댓글 0