@@ -8,13 +8,15 @@ The database is found in Windows 10 systems and present at `C:\ProgramData\Micro
88
99The tool currently supports the following features.
1010
11- + Extracting MS Edge browser history.
12- + Extracting list of software/programs installed on the host system.
13- + Extracting Wireless Scan results.
14- + Extracting WiFi connection details (SSIDs, device manufacturers etc...)
15- + Extracting Physical Disk information (Disk size, No. of partitions etc...)
16- + Extracting PnP device installation information (Install time, Model, Manufacturer etc...)
17- + MORE COMING SOON!!
11+ + Extracts Microsoft Edge browsing history
12+ + Extracts application inventory
13+ + Extracts Wireless scan results.
14+ + Extracts successful WiFi connection events
15+ + Extracts User's default preferences (Video player, default browser etc...)
16+ + Extracts SRUM information
17+ + Application execution
18+ + Application network usage
19+ + Extracts Application execution activity
1820
1921### Requirements
2022
@@ -23,18 +25,17 @@ Python 3.8 or above. The older versions of Python 3.x should work fine as well.
2325#### Dependencies
2426
2527These are the required python libraries/modules needed to run the script
28+
2629+ json
27- + sqlite3
28- + pandas
2930+ os
31+ + sqlalchemy
32+ + csv
3033+ argparse
3134
32- All the above modules are available by default in python3 except ** Pandas** .
33-
34- To install pandas, use ` pip ` via command prompt/terminal.
35+ All the above modules are available by default in python3. Incase one or the other is missing, you can install by
3536
36- ``` sh
37- pip install pandas
37+ ```
38+ pip install <package-name>
3839```
3940
4041### Usage
@@ -46,14 +47,14 @@ The tool is completely CLI based and there are 2 ways to use it.
4647#### Using Python
4748
4849``` python
49- python EventTranscriptParser.py - f < Path- To- EventTranscript.db> - o < Path- To- Output- Directory>
50+ python3 EventTranscriptParser.py - f < Path- To- EventTranscript.db> - o < Path- To- Output- Directory>
5051```
5152![ usage] ( ./img/usage.png )
5253
5354
5455To view help,
5556```
56- python EventTranscriptParser.py -h
57+ python3 EventTranscriptParser.py -h
5758```
5859
5960![ help] ( ./img/help.png )
@@ -68,9 +69,7 @@ Download the executable from https://github.com/stuxnet999/EventTranscriptParser
6869.\E ventTranscriptParser.exe -f .\E ventTranscript.db -o .\C SV-Output\
6970```
7071
71- ![ exe-usage] ( ./img/exe-usage.png )
72-
73- The executable was compiled using ` pyinstaller ` version ** 4.5.1** .
72+ The executable was compiled using ` pyinstaller ` .
7473
7574#### Compiling on your own
7675
0 commit comments