GrokEVT is a collection of scripts built for reading Windows® NT/2K/XP/2K3 event log files. GrokEVT is released under the GNU GPL, and is implemented in Python.
Python Makefile Shell
Switch branches/tags
Nothing to show
Clone or download
tim
tim .
git-svn-id: file:///bss/svn/public/grokevt@122 15c2d14c-5af0-0310-93da-fd3504e6cab1
Latest commit 3f999e7 Aug 21, 2015
Permalink
Failed to load latest commit information.
releases releasing 0.5.0 Jun 20, 2011
trunk python 3 fixes, install doc clarification Jun 20, 2011
Makefile fix for changed DNS Sep 27, 2008
README.md . Aug 21, 2015

README.md

What is this?

GrokEVT is a collection of scripts built for reading Windows® NT/2K/XP/2K3 event log files. GrokEVT is released under the GNU GPL, and is implemented in Python. The scripts work together on one or more mounted Windows® partitions to extract all information needed (registry entries, message templates, and log files) to convert the logs to a human-readable format.

Where do I learn more?

See the main project site. You'll find official releases there and more documentation.

What if I have trouble?

Ask for help on the development mailing list or submit an issue here on GitHub.

Is this project maintained anymore?

GrokEVT is quickly becoming obsolete since it only supports the log format used in Windows 2003 and earlier. Newer versions of Windows use an even more complex (inane) file format for storing logs and I've never found the time/motivation to add support for the newer format. The newer format has been documented by other forensics researchers though, and I'd certainly help out if someone wanted to step in and add that support to GrokEVT.

How do I contribute?

We love contributions. However, for now this GitHub mirror is just that, a static mirror, so please don't submit pull requests. Just send us patches on the development mailing list.