LfLe Logo

LfLe

0
Free
Visit Website

Recover event log entries from an image by heuristically looking for record structures. Dependencies: argparse (http://pypi.python.org/pypi/argparse available via easy_install/pip). Usage: Use this tool to extract event log messages from an image file by looking for things that appear to be records. Then, feed the resulting file into an event log viewer, such as Event Log Explorer (http://www.eventlogxp.com/, use 'direct' mode when opening). Sample Output: evt/LfLe - [master●] » python lfle.py '/media/truecrypt2/VM/Windows XP Professional - Service Pack 3 - TEMPLATE/Windows XP Professional - Service Pack 3-cl1.vmdk' recovered.evt 100% complete% done. Wrote 5413 records. Skipped 48 records with length greater than 0x10000. Skipped 12.

FEATURES

ALTERNATIVES

A high-performance digital forensics exploitation tool for extracting structured information from various inputs without parsing file system structures.

Tool for live forensics acquisition on Windows systems, collecting artefacts for early compromise detection.

A Mac OS X forensic utility for ensuring correct forensic procedures during disk imaging.

Recreates the File/Directory tree structure from an extracted $MFT file with detailed record mapping and analysis capabilities.

A tool for extracting files from packet capture files with ease of use and extensibility for Python developers.

RegRippy is a modern Python 3 alternative to RegRipper for extracting data from Windows registry hives.

Universal hexadecimal editor for computer forensics, data recovery, and IT security.

ID-spoofing NFS client

PINNED