You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+39-3Lines changed: 39 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -29,16 +29,27 @@ These are the required python libraries/modules needed to run the script
29
29
+ os
30
30
+ argparse
31
31
32
+
All the above modules are available by default in python3 except **Pandas**.
33
+
34
+
To install pandas, use `pip` via command prompt/terminal.
35
+
36
+
```sh
37
+
pip install pandas
38
+
```
39
+
32
40
### Usage
33
41
34
-
The tool is completely CLI based.
42
+
**Tip**: Before running the tool against the database, make sure that the **-wal (Write Ahead Log)** file data is merged with the original database. Because you might miss out on crucial/juicy data.
43
+
44
+
The tool is completely CLI based and there are 2 ways to use it.
**Tip**: Before running the tool against the database, make sure that the **-wal (Write Ahead Log)** file data is merged with the original database. Because you might miss out on crucial/juicy data.
If you do not have python pre-installed in you system or have issues with the running the script, you can use the compiled executable. The executable is also CLI based.
64
+
65
+
Download the executable from https://github.com/stuxnet999/EventTranscriptParser/releases
The executable was compiled using `pyinstaller` version **4.5.1**.
74
+
75
+
#### Compiling on your own
76
+
77
+
If you wish to compile on your own, use the commands below in any command prompt/terminal window.
78
+
79
+
```sh
80
+
pip install pyinstaller
81
+
pyinstaller --onefile EventTranscriptParser.py
82
+
```
83
+
84
+
You will find the compiled executable in the `dist` directory.
85
+
50
86
### Acknowledgements
51
87
52
88
This tool wouldn't have been possible without the excellent research & hard work put in by my colleagues [Andrew Rathbun](https://twitter.com/bunsofwrath12) & [Josh Mitchell](https://www.linkedin.com/in/josh-mitchell-0990ba6a/) in investigating the Windows Diagnostic Data.
@@ -60,4 +96,4 @@ Follow the investigative series at Kroll on EventTranscript.db - https://www.kro
0 commit comments