python-evt
Event log parser
A Python module for parsing classic Windows Event Log files (.evt)
Pure Python parser for classic Windows Event Log files (.evt)
48 stars
6 watching
11 forks
Language: Python
last commit: over 1 year ago
Linked from 2 awesome lists
rshipp/awesome-malware-analysis
cugu/awesome-forensicsRelated projects:
| Repository | Description | Stars |
|---|---|---|
| williballenthin/python-evtx | A Python module for parsing Windows Event Log files (.evtx) into structured data | 732 |
| williballenthin/evtxtract | Reconstructs fragments of event log data from raw binary files, including unallocated space and memory images. | 189 |
| williballenthin/shellbags | This tool helps reconstruct user activities by parsing Windows Registry data. | 149 |
 fox-it/dissect.eventlog | This is a Python module that parses Windows log file formats | 6 |
 yarox24/evtkit | Tool to repair Windows Event Log files (.evt) acquired during forensic investigations | 18 |
 sumeshi/evtx2es | A Python library that enables fast import of Windows Event Logs into Elasticsearch | 82 |
 ericzimmerman/evtx | Tool to parse Event Viewer logs and extract useful information | 282 |
| williballenthin/lfle | Recover event log entries from an image by identifying record structures. | 27 |
| williballenthin/process-forest | Tools for reconstructing historical process hierarchies from Windows event logs. | 146 |
 ecbftw/grokevt | A collection of Python scripts to extract information from Windows event log files | 10 |
 reed1713/elat | A toolset for analyzing Windows event logs to detect and analyze malware | 29 |
| williballenthin/indxparse | A tool suite for parsing NTFS artifacts and extracting information from INDX files. | 216 |
| williballenthin/python-idb | A library that provides read-only access to internal structures of IDA Pro databases and analyzes logical elements from these structures | 458 |
 abrignoni/aleapp | An Android log parser and Protobuf analyzer written in Python | 525 |
| williballenthin/python-ntfs | A Python library for analyzing and working with NTFS file systems. | 80 |