ArtifactParsers

KO | EN

gitlite — search

#hacktoberfest #llm #android #rust #deep-learning #docker #java #windows #cli #vue #awesome-list #openai #ios #open-source

ArtifactParsers

(★ 82)

A repo that aims to centralize a current, running list of relevant parsers/tools for known DFIR artifacts

ArtifactParsers Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# ArtifactParsers

A repo that aims to centralize a current, running list of relevant parsers/tools for known DFIR artifacts.

## What makes this different from any other list of DFIR tools?

Ideally, the community will maintain this as tools come and go from relevance. If a tool is listed below, the community is vouching for it that it still works and is an excellent option to solve whatever problem you may be facing with a particular artifact.

## Commercial Tool Disclaimer

It's not that commercial tools aren't welcome in this list, but the table would become pretty bloated when you have 5+ tools duplicated in many cells. At the very minimum, this project aims to highlight single-purpose tools made by the DFIR community members to allow for greater visibility at the options (often at no cost) for those looking to solve problems in their everyday investigations.

Much love for the commercial vendors, their efforts, and their contributions to the community, but it would be ideal for anyone looking to learn more about the capabilities of a commercial tool to reach out to the vendor themselves or visit their official website for more information.

## Analyzers vs. Parsers

In the instance of Windows Event Logs, the Windows Registry, and possibly other artifacts, there is a distinct difference between a tool that analyzes an artifact and parses the artifact. Generally speaking, an analysis tool would do something similar to running YARA or SIGMA rules against a set of artifacts and provide meaningful output based on the rulesets used. A parser would provide raw output without any predetermined rulesets or logic applied to the set of artifacts, leaving the analysis and interpretation to the end examiner.

This is an important distinction to make with this project because, in the example of Windows Event Logs, it would be troublesome to lead an examiner looking for a tool to parse Windows Event Logs to think that a tool like Chainsaw, Hayabusa, or Zircolite will parse event logs when in reality they analyze the event logs using rulesets and logic created by threat researchers. Those tools do not PARSE the event logs like EvtxECmd, etc.

## Contributing

Please contribute to this list if any artifacts and their corresponding tools still need to be included!

## Windows

| DFIR Artifact | CLI Tool(s) | GUI Tool(s) |
|--------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| $I30 | [go-ntfs](https://github.com/Velocidex/go-ntfs) [Index2Csv](https://github.com/jschicht/Indx2Csv) [IndexCarver](https://github.com/jschicht/IndxCarver) [MFTECmd](https://ericzimmerman.github.io/#!index.md) | |
| $J | [dfir_ntfs](https://github.com/msuhanov/dfir_ntfs) [ExtractUsnJrnl](https://github.com/jschicht/ExtractUsnJrnl) [go-ntfs](https://github.com/Velocidex/go-ntfs) [MFTECmd](https://ericzimmerman.github.io/#!index.md) | [NTFS Log Tracker](https://sites.google.com/site/forensicnote/ntfs-log-tracker) |
| $LogFile | [dfir_ntfs](https://github.com/msuhanov/dfir_ntfs) [go-ntfs](https://github.com/Velocidex/go-ntfs) [LogFileParser](https://github.com/jschicht/LogFileParser) [RcrdCarver](https://github.com/jschicht/RcrdCarver) | [NTFS Log Tracker](https://sites.google.com/site/forensicnote/ntfs-log-tracker) |
| $MFT | [dfir_ntfs](https://github.com/msuhanov/dfir_ntfs) [Mft2Csv](https://github.com/jschicht/Mft2Csv) [MftCarver](https://github.com/jschicht/MftCarver) [MFTECmd](https://ericzimmerman.github.io/#!index.md) [MftRcrd](https://github.com/jschicht/MftRcrd) | [MFT_Browser](https://github.com/kacos2000/MFT_Browser) [MFTExplorer](https://ericzimmerman.github.io/#!index.md) [NTFS Log Tracker](https://sites.google.com/site/forensicnote/ntfs-log-tracker) |
| $SDS | [MFTECmd](https://ericzimmerman.github.io/#!index.md) [Secure2Csv](https://github.com/jschicht/Secure2Csv) | |
| Amcache | [AmcacheParser](https://ericzimmerman.github.io/#!index.md) | [Registry Explorer](https://ericzimmerman.github.io/#!index.md) |
| AppCompatCache (ShimCache) | [AppCompatCacheParser](https://ericzimmerman.github.io/#!index.md) | [Registry Explorer](https://ericzimmerman.github.io/#!index.md) |
| AppCompatCache PCA (Windows 11 only) | [PCAParser](https://github.com/AndrewRathbun/PCAParser) | |
| Browsing History | [BrowsingHistoryView](https://www.nirsoft.net/utils/browsing_history_view.html) [Hindsight](https://github.com/obsidianforensics/hindsight) - Chromium only [SQLECmd](https://ericzimmerman.github.io/#!index.md) - SQLite only | [BrowsingHistoryView](https://www.nirsoft.net/utils/browsing_history_view.html) [Browser History Viewer](https://www.foxtonforensics.com/browser-history-viewer/) |
| CSV Files | | [Modern CSV](https://www.moderncsv.com/) [Timeline Explorer](https://ericzimmerman.github.io/#!index.md) |
| Email (MBOX) | [mbox-web-viewer](https://github.com/PHMRanger/mbox-web-viewer) | [mboxviewer](https://github.com/eneam/mboxviewer) |
| Email (OST/PST) | [XstExporter](https://github.com/iluvadev/XstReader#xstexporter) | [XstReader](https://github.com/iluvadev/XstReader) |
| ESE Databases (General) | [WindowsEDB-to-CSV](https://github.com/kacos2000/WinEDB) | [ESEDatabaseView](https://www.nirsoft.net/utils/ese_database_view.html) [WinEDB](https://github.com/kacos2000/WinEDB) |
| ETL Files | [ETLParser](https://github.com/forensiclunch/ETLParser) | |
| Event Logs (.evtx) - Analyzers | [Chainsaw](https://github.com/WithSecureLabs/chainsaw) [EvtxHussar](https://github.com/yarox24/EvtxHussar) [Hayabusa](https://github.com/Yamato-Security/hayabusa) [Zircolite](https://github.com/wagga40/Zircolite) | |
| Event Logs (.evtx) - Parsers | [Events-Ripper](https://github.com/keydet89/Events-Ripper) [EvtxECmd](https://ericzimmerman.github.io/#!index.md) | [Event Log Explorer](https://www.eventlogxp.com/) [Event Log Observer](https://lizard-labs.com/event_log_observer.aspx) [Evtx_Log_Browser](https://github.com/kacos2000/Evtx_Log_Browser) [FullEventLogView](https://www.nirsoft.net/utils/full_event_log_view.html) [LogViewPlus](https://www.logviewplus.com/log-viewer.html) |
| Google Drive | [gMetaDataParse](https://github.com/00010111/gMetaDataParse) | [gMetaDataParse](https://github.com/00010111/gMetaDataParse) |
| IIS Logs | [IISGeoLocate](https://ericzimmerman.github.io/#!index.md) | [LogViewPlus](https://www.logviewplus.com/log-viewer.html) |
| Image Mounting | [Arsenal Image Mounter](https://arsenalrecon.com/downloads) | [Arsenal Image Mounter](https://arsenalrecon.com/downloads) |
| IP Address GeoLocation | [Abeebus](https://github.com/13Cubed/Abeebus) | |
| JumpLists | [JLECmd](https://ericzimmerman.github.io/#!index.md) | [Jumplist-Browser](https://github.com/kacos2000/Jumplist-Browser) [JumpList Explorer](https://ericzimmerman.github.io/#!index.md) |
| LevelDB | [LevelDBDumper](https://github.com/mdawsonuk/LevelDBDumper) | [LevelDB Recon](https://arsenalrecon.com/downloads) |
| LNK Files | [LECmd](https://ericzimmerman.github.io/#!index.md) | [Jumplist-Browser](https://github.com/kacos2000/Jumplist-Browser) |
| MalwareBytes Logs | [MBAMServiceLogParser.ps1](https://github.com/AndrewRathbun/DFIRPowerShellScripts/blob/main/MBAMServiceLogParser.ps1) | |
| NetWire Logs | [NetWireLogDecoder](https://github.com/ArsenalRecon/NetWireLogDecoder) | |
| OneDrive | [OneDrive .ODL Parser](https://github.com/ydkhatri/OneDrive) [OneDriveExplorer](https://github.com/Beercow/OneDriveExplorer) | [OneDriveExplorer](https://github.com/Beercow/OneDriveExplorer) |
| Prefetch | [PECmd](https://ericzimmerman.github.io/#!index.md) | [Prefetch-Browser](https://github.com/kacos2000/Prefetch-Browser) [WinPrefetchView](https://www.nirsoft.net/utils/win_prefetch_view.html) |
| RAM (Memory) | [Memory-Baseliner](https://github.com/csababarta/memory-baseliner) [Volatility](https://www.volatilityfoundation.org/releases) | [MemProcFS](https://github.com/ufrisk/MemProcFS) [Volatility Workbench](https://www.osforensics.com/tools/volatility-workbench.html) |
| RDP Bitmap Cache | [BMC-Tools](https://github.com/dingtoffee/bmc-tools) | |
| Recycle Bin | [RBCmd](https://ericzimmerman.github.io/#!index.md) | |
| RecentFileCache | [RecentFileCacheParser](https://ericzimmerman.github.io/#!index.md) | |
| Registry - Analyzers | [reg_hunter](https://github.com/theflakes/reg_hunter) | |
| Registry - Comparison Tools | | [RegistryChangesView](https://www.nirsoft.net/utils/registry_changes_view.html) [RegShot-Advanced](https://github.com/skydive241/Regshot-Advanced) |
| Registry - Parsers | [jarp](https://github.com/ydkhatri/jarp) [RECmd](https://ericzimmerman.github.io/#!index.md) [Registry Recon](https://arsenalrecon.com/downloads) [RegRipper](https://github.com/keydet89/RegRipper3.0) [yarp](https://github.com/msuhanov/yarp) | [Registry Explorer](https://ericzimmerman.github.io/#!index.md) |
| Shellbags | [SBECmd](https://ericzimmerman.github.io/#!index.md) | [Shellbags Explorer](https://ericzimmerman.github.io/#!index.md) |
| Shim Databases | | [SDB Explorer](https://ericzimmerman.github.io/#!index.md) |
| SQLite Databases | [SQLECmd](https://ericzimmerman.github.io/#!index.md) | [DB Browser for SQLite](https://sqlitebrowser.org/) [FQLite](https://github.com/pawlaszczyk/fqlite) [Navicat for SQLite](https://navicat.com/en/products/navicat-for-sqlite) [SQLiteStudio](https://sqlitestudio.pl/) |
| SRUM Database (ESE) | [SrumECmd](https://ericzimmerman.github.io/#!index.md) [srum-dump](https://github.com/MarkBaggett/srum-dump) | |
| SUM Database (ESE) | [SumECmd](https://ericzimmerman.github.io/#!index.md) | |
| Symantec AV Logs | [SEParser](https://github.com/Beercow/SEPparser) | [SEParser](https://github.com/Beercow/SEPparser) |
| Thumbcache | [Thumbcache Viewer (CMD)](https://github.com/thumbcacheviewer/thumbcacheviewer/releases/tag/v1.0.2.0) | [Thumbcache Viewer](https://github.com/thumbcacheviewer/thumbcacheviewer) |
| Volume Shadow Copies | [VSCMount](https://ericzimmerman.github.io/#!index.md) | [ShadowExplorer](https://shadowexplorer.com/) |
| Windows Timeline | [WxTCmd](https://ericzimmerman.github.io/#!index.md) [Windows Timeline PowerShell Scripts](https://github.com/kacos2000/WindowsTimeline) | [Clippy.exe](https://github.com/kacos2000/WindowsTimeline/releases) [WindowsTimeline.exe](https://github.com/kacos2000/WindowsTimeline/releases) |
| WBEM (WMI) | [flare-wmi](https://github.com/mandiant/flare-wmi) [PyWMIPersistenceFinder](https://github.com/davidpany/WMI_Forensics) [WMIParserStr](https://github.com/AndrewRathbun/WMIParserStr) [WMI-Parser](https://github.com/AndrewRathbun/WMI-Parser) | [WMI-Explorer](https://github.com/AndrewRathbun/WMI-Explorer) |
| Windows Defender Logs | [DHParser](https://github.com/jklepsercyber/defender-detectionhistory-parser) | |
| Windows Search Index Database | [SIDR](https://github.com/strozfriedberg/sidr) [WinEDB](https://github.com/kacos2000/WinEDB) | [WinSearchDBAnalyzer](https://github.com/AndrewRathbun/WinSearchDBAnalyzer) [WinEDB](https://github.com/kacos2000/WinEDB) |

## Android

| DFIR Artifact | CLI Tool(s) | GUI Tools(s) |
|-------------------|---------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Android Artifacts | [ALEAPP](https://github.com/abrignoni/ALEAPP) [Andriller](https://github.com/den4uk/andriller) | [ALEAPP](https://github.com/abrignoni/ALEAPP) [Andriller](https://github.com/den4uk/andriller) [Avilla Forensics](https://github.com/AvillaDaniel/AvillaForensics) |
| SQLite Databases | [SQLECmd](https://ericzimmerman.github.io/#!index.md) | [DB Browser for SQLite](https://sqlitebrowser.org/) [FQLite](https://github.com/pawlaszczyk/fqlite) |

## iOS

| DFIR Artifact | CLI Tool(s) | GUI Tools(s) |
|------------------|-------------------------------------------------------|---------------------------------------------------------------|
| iOS Artifacts | [iLEAPP](https://github.com/abrignoni/iLEAPP) | [ArtEx](https://www.doubleblak.com/app.php?id=ArtEx2) [iLEAPP](https://github.com/abrignoni/iLEAPP) |
| PList Files | | [Mushy](https://www.doubleblak.com/app.php?id=Mushy) [plist Editor Pro](https://www.icopybot.com/plist-editor.htm) |
| SQLite Databases | [SQLECmd](https://ericzimmerman.github.io/#!index.md) | [DB Browser for SQLite](https://sqlitebrowser.org/) [FQLite](https://github.com/pawlaszczyk/fqlite) |
| Advanced logical backup & acquisition | | [UFADE](https://github.com/prosch88/UFADE)

## macOS

| DFIR Artifact   | CLI Tool(s)                                    | GUI Tools(s) |
|-----------------|------------------------------------------------|--------------|
| macOS Artifacts | [mac_apt](https://github.com/ydkhatri/mac_apt) |              |

ArtifactParsers

ArtifactParsers Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

ArtifactParsers

ArtifactParsers Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README