evtkit Logo

evtkit

0
Free
Visit Website

evtkit is a tool used for fixing acquired .evt Windows Event Log files in the field of digital forensics. It requires Python 2 (not tested on 3) with no external dependencies. Users can fix .evt files in-place by running evtkit.py on files like AppEvent.Evt and SysEvent.Evt. Additionally, it can find all *.evt files in evt_dir/, copy them to fixed_copy/, and repair them. The tool also offers options such as -h or --help to display the help message, -c or --copy_to_dir to specify the output directory for fixed .evt files, and -q or --quiet to turn off verbosity.

FEATURES

ALTERNATIVES

A library to access and parse Windows XML Event Log (EVTX) format, useful for digital forensics and incident response.

Autopsy is a GUI-based digital forensics platform for analyzing hard drives and smart phones, with a plug-in architecture for custom modules.

A tool for triaging crash files with various output formats and debugging engine options.

A suite of console tools for working with timestamps in Windows with 100-nanosecond precision.

A high-performance digital forensics exploitation tool for extracting structured information from various inputs without parsing file system structures.

Digital investigation tool for extracting forensic data from computers and managing investigations.

Remote Acquisition Tool

Python tool for remotely or locally dumping RAM of a Linux client for digital forensics analysis.

PINNED