LfLe Logo

LfLe

0
Free
Visit Website

Recover event log entries from an image by heuristically looking for record structures. Dependencies: argparse (http://pypi.python.org/pypi/argparse available via easy_install/pip). Usage: Use this tool to extract event log messages from an image file by looking for things that appear to be records. Then, feed the resulting file into an event log viewer, such as Event Log Explorer (http://www.eventlogxp.com/, use 'direct' mode when opening). Sample Output: evt/LfLe - [master●] » python lfle.py '/media/truecrypt2/VM/Windows XP Professional - Service Pack 3 - TEMPLATE/Windows XP Professional - Service Pack 3-cl1.vmdk' recovered.evt 100% complete% done. Wrote 5413 records. Skipped 48 records with length greater than 0x10000. Skipped 12.

FEATURES

ALTERNATIVES

Open Backup Extractor is an open source program for extracting data from iPhone and iPad backups.

A free, open source collection of tools for forensic artifact and image analysis.

Python tool for remotely or locally dumping RAM of a Linux client for digital forensics analysis.

Free software for extracting Microsoft cabinet files, supporting all features and formats of Microsoft cabinet files and Windows CE installation files.

A network forensics tool for visualizing packet captures as network diagrams with detailed analysis.

Create checkpoint snapshots of the state of running pods for later off-line analysis.

A collection of tools for extracting and analyzing information from .git repositories

Fridump is an open source memory dumping tool using the Frida framework for dumping memory addresses from various platforms.