Skip to content

Commit afbda05

Browse files
committed
Add executable & update readme
1 parent cafd173 commit afbda05

File tree

3 files changed

+39
-3
lines changed

3 files changed

+39
-3
lines changed

EventTranscriptParser.exe

27.6 MB
Binary file not shown.

README.md

Lines changed: 39 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,16 +29,27 @@ These are the required python libraries/modules needed to run the script
2929
+ os
3030
+ argparse
3131

32+
All the above modules are available by default in python3 except **Pandas**.
33+
34+
To install pandas, use `pip` via command prompt/terminal.
35+
36+
```sh
37+
pip install pandas
38+
```
39+
3240
### Usage
3341

34-
The tool is completely CLI based.
42+
**Tip**: Before running the tool against the database, make sure that the **-wal (Write Ahead Log)** file data is merged with the original database. Because you might miss out on crucial/juicy data.
43+
44+
The tool is completely CLI based and there are 2 ways to use it.
45+
46+
#### Using Python
3547

3648
```python
3749
python EventTranscriptParser.py -f <Path-To-EventTranscript.db> -o <Path-To-Output-Directory>
3850
```
3951
![usage](./img/usage.png)
4052

41-
**Tip**: Before running the tool against the database, make sure that the **-wal (Write Ahead Log)** file data is merged with the original database. Because you might miss out on crucial/juicy data.
4253

4354
To view help,
4455
```
@@ -47,6 +58,31 @@ python EventTranscriptParser.py -h
4758

4859
![help](./img/help.png)
4960

61+
#### Using Executable
62+
63+
If you do not have python pre-installed in you system or have issues with the running the script, you can use the compiled executable. The executable is also CLI based.
64+
65+
Download the executable from https://github.com/stuxnet999/EventTranscriptParser/releases
66+
67+
```sh
68+
.\EventTranscriptParser.exe -f .\EventTranscript.db -o .\CSV-Output\
69+
```
70+
71+
![exe-usage](./img/exe-usage.png)
72+
73+
The executable was compiled using `pyinstaller` version **4.5.1**.
74+
75+
#### Compiling on your own
76+
77+
If you wish to compile on your own, use the commands below in any command prompt/terminal window.
78+
79+
```sh
80+
pip install pyinstaller
81+
pyinstaller --onefile EventTranscriptParser.py
82+
```
83+
84+
You will find the compiled executable in the `dist` directory.
85+
5086
### Acknowledgements
5187

5288
This tool wouldn't have been possible without the excellent research & hard work put in by my colleagues [Andrew Rathbun](https://twitter.com/bunsofwrath12) & [Josh Mitchell](https://www.linkedin.com/in/josh-mitchell-0990ba6a/) in investigating the Windows Diagnostic Data.
@@ -60,4 +96,4 @@ Follow the investigative series at Kroll on EventTranscript.db - https://www.kro
6096
Abhiram Kumar
6197

6298
+ Twitter: [@_abhiramkumar](https://www.twitter.com/_abhiramkumar)
63-
+ Personal blog: https://stuxnet999.github.io
99+
+ Personal blog: https://stuxnet999.github.io

img/exe-usage.png

58.8 KB
Loading

0 commit comments

Comments
 (0)