EvtxCarv
by Chanung Pak, Jaeman Park, HyeonGyu Jang
EvtxCarv is a tool for fragmented Evtx files forensics.
Supported platforms
- Windows (VS 2010) C++
Usage
Execute EvtxCarv to analyze an image file
EvtxCarv.exe (-r|-c) 'target image path' 'output path'
Options
--record (-r) : Recover by record
--complete (-c) : Recover by chunk
Examples of usage
EvtxCarv.exe -c c:\\image.raw c:\\output\\
EvtxCarv.exe -r image.raw output
License
Feedback
Please submit feedback via the EvtxCarv tracker
Author: Chanung Pak (kkoha@msn.com)