DFIR Toolkit: CLI tools for forensic investigation of Windows artifacts

Usage: evtx2bodyfile [OPTIONS] [EVTX_FILES]...

Arguments:
  [EVTX_FILES]...  names of the evtx files

Options:
  -J, --json        output json for elasticsearch instead of bodyfile
  -S, --strict      fail upon read error
  -v, --verbose...  More output per occurrence
  -q, --quiet...    Less output per occurrence
  -h, --help        Print help
  -V, --version     Print version

# convert to bodyfile only
evtx2bodyfile Security.evtx >Security.bodyfile

# create a complete timeline
evtx2bodyfile *.evtx | mactime2 -d -b >evtx_timeline.csv

Usage: evtxanalyze [OPTIONS] <COMMAND>

Commands:
  pstree    generate a process tree
  sessions  display sessions
  session   display one single session
  help      Print this message or the help of the given subcommand(s)

Options:
  -v, --verbose...  More output per occurrence
  -q, --quiet...    Less output per occurrence
  -h, --help        Print help

Find time skews in an evtx file

Usage: evtxscan [OPTIONS] <EVTX_FILE>

Arguments:
  <EVTX_FILE>  name of the evtx file to scan

Options:
  -S, --show-records                             display also the contents of the records befor and after a time skew
  -N, --negative-tolerance <NEGATIVE_TOLERANCE>  negative tolerance limit (in seconds): time skews to the past below this limit will be ignored [default: 5]
  -h, --help                                     Print help
  -V, --version                                  Print version

Usage: evtxcat [OPTIONS] <EVTX_FILE>

Arguments:
  <EVTX_FILE>  Name of the evtx file to read from

Options:
      --min <MIN>        filter: minimal event record identifier
      --max <MAX>        filter: maximal event record identifier
  -i, --id <ID>          show only the one event with this record identifier
  -T, --display-table    don't display the records in a table format
  -F, --format <FORMAT>  [default: xml] [possible values: json, xml]
  -h, --help             Print help
  -V, --version          Print version

Usage: evtxls [OPTIONS] [EVTX_FILES]...

Arguments:
  [EVTX_FILES]...
          Name of the evtx files to read from

Options:
  -d, --delimiter <DELIMITER>
          use this delimiter instead of generating fixed space columns

  -i, --include <INCLUDED_EVENT_IDS>
          List events with only the specified event ids, separated by ','

  -x, --exclude <EXCLUDED_EVENT_IDS>
          Exclude events with the specified event ids, separated by ','

  -c, --colors
          highlight interesting content using colors

  -f, --from <NOT_BEFORE>
          hide events older than the specified date (hint: use RFC 3339 syntax)

  -t, --to <NOT_AFTER>
          hide events newer than the specified date (hint: use RFC 3339 syntax)

  -r, --regex <HIGHLIGHT>
          highlight event data based on this regular expression

  -s, --sort <SORT_ORDER>
          sort order
          
          [default: storage]

          Possible values:
          - storage:   don't change order, output records as they are stored
          - record-id: sort by event record id
          - time:      sort by date and time

  -b, --base-fields <DISPLAY_SYSTEM_FIELDS>
          display fields common to all events. multiple values must be separated by ','
          
          [default: event-id event-record-id]

          Possible values:
          - event-id:            The identifier that the provider used to identify the event
          - event-record-id:     The record number assigned to the event when it was logged
          - activity-id:         A globally unique identifier that identifies the current activity. The events that are published with this identifier are part of the same activity
          - related-activity-id: A globally unique identifier that identifies the activity to which control was transferred to. The related events would then have this identifier as their ActivityID identifier
          - process-id:          The ID of the process that created the event

  -B, --hide-base-fields
          don't display any common event fields at all. This corresponds to specifying '--base-fields' without any values (which is not allowed, that's why there is this flag)

  -h, --help
          Print help (see a summary with '-h')

  -V, --version
          Print version

Usage: es4forensics [OPTIONS] --index <INDEX_NAME> --password <PASSWORD> <COMMAND>

Commands:
  create-index  
  import        
  help          Print this message or the help of the given subcommand(s)

Options:
  -v, --verbose...           More output per occurrence
  -q, --quiet...             Less output per occurrence
      --strict               strict mode: do not only warn, but abort if an error occurs
  -I, --index <INDEX_NAME>   name of the elasticsearch index
  -H, --host <HOST>          server name or IP address of elasticsearch server [default: localhost]
  -P, --port <PORT>          API port number of elasticsearch server [default: 9200]
      --proto <PROTOCOL>     protocol to be used to connect to elasticsearch [default: https] [possible values: http, https]
  -k, --insecure             omit certificate validation
  -U, --username <USERNAME>  username for elasticsearch server [default: elastic]
  -W, --password <PASSWORD>  password for authenticating at elasticsearch
  -h, --help                 Print help
  -V, --version              Print version

USAGE:
    pol_export <POLFILE>

ARGS:
    <POLFILE>    Name of the file to read

OPTIONS:
    -h, --help       Print help information
    -V, --version    Print version information

Usage: regdump [OPTIONS] <HIVE_FILE>

Arguments:
  <HIVE_FILE>  name of the file to dump

Options:
  -L, --log <LOGFILES>     transaction LOG file(s). This argument can be specified one or two times
  -b, --bodyfile           print as bodyfile format
  -I, --ignore-base-block  ignore the base block (e.g. if it was encrypted by some ransomware)
  -T, --hide-timestamps    hide timestamps, if output is in reg format
  -v, --verbose...         More output per occurrence
  -q, --quiet...           Less output per occurrence
  -h, --help               Print help
  -V, --version            Print version