Skip to content

Commit 8592a80

Browse files
committed
Update code
Updated code and added a few new features to the tool
1 parent afbda05 commit 8592a80

File tree

6 files changed

+277
-247
lines changed

6 files changed

+277
-247
lines changed

EventTranscriptParser.exe

-27.6 MB
Binary file not shown.

EventTranscriptParser.py

Lines changed: 259 additions & 228 deletions
Large diffs are not rendered by default.

README.md

Lines changed: 18 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,15 @@ The database is found in Windows 10 systems and present at `C:\ProgramData\Micro
88

99
The tool currently supports the following features.
1010

11-
+ Extracting MS Edge browser history.
12-
+ Extracting list of software/programs installed on the host system.
13-
+ Extracting Wireless Scan results.
14-
+ Extracting WiFi connection details (SSIDs, device manufacturers etc...)
15-
+ Extracting Physical Disk information (Disk size, No. of partitions etc...)
16-
+ Extracting PnP device installation information (Install time, Model, Manufacturer etc...)
17-
+ MORE COMING SOON!!
11+
+ Extracts Microsoft Edge browsing history
12+
+ Extracts application inventory
13+
+ Extracts Wireless scan results.
14+
+ Extracts successful WiFi connection events
15+
+ Extracts User's default preferences (Video player, default browser etc...)
16+
+ Extracts SRUM information
17+
+ Application execution
18+
+ Application network usage
19+
+ Extracts Application execution activity
1820

1921
### Requirements
2022

@@ -23,18 +25,17 @@ Python 3.8 or above. The older versions of Python 3.x should work fine as well.
2325
#### Dependencies
2426

2527
These are the required python libraries/modules needed to run the script
28+
2629
+ json
27-
+ sqlite3
28-
+ pandas
2930
+ os
31+
+ sqlalchemy
32+
+ csv
3033
+ argparse
3134

32-
All the above modules are available by default in python3 except **Pandas**.
33-
34-
To install pandas, use `pip` via command prompt/terminal.
35+
All the above modules are available by default in python3. Incase one or the other is missing, you can install by
3536

36-
```sh
37-
pip install pandas
37+
```
38+
pip install <package-name>
3839
```
3940

4041
### Usage
@@ -46,14 +47,14 @@ The tool is completely CLI based and there are 2 ways to use it.
4647
#### Using Python
4748

4849
```python
49-
python EventTranscriptParser.py -f <Path-To-EventTranscript.db> -o <Path-To-Output-Directory>
50+
python3 EventTranscriptParser.py -f <Path-To-EventTranscript.db> -o <Path-To-Output-Directory>
5051
```
5152
![usage](./img/usage.png)
5253

5354

5455
To view help,
5556
```
56-
python EventTranscriptParser.py -h
57+
python3 EventTranscriptParser.py -h
5758
```
5859

5960
![help](./img/help.png)
@@ -68,9 +69,7 @@ Download the executable from https://github.com/stuxnet999/EventTranscriptParser
6869
.\EventTranscriptParser.exe -f .\EventTranscript.db -o .\CSV-Output\
6970
```
7071

71-
![exe-usage](./img/exe-usage.png)
72-
73-
The executable was compiled using `pyinstaller` version **4.5.1**.
72+
The executable was compiled using `pyinstaller`.
7473

7574
#### Compiling on your own
7675

img/exe-usage.png

-58.8 KB
Binary file not shown.

img/help.png

3.54 KB
Loading

img/usage.png

26.8 KB
Loading

0 commit comments

Comments
 (0)