EvtxCarv

by Chanung Pak, Jaeman Park, HyeonGyu Jang

EvtxCarv is a tool for fragmented Evtx files forensics.

Supported platforms

• Windows (VS 2010) C++

Usage

Execute EvtxCarv to analyze an image file

EvtxCarv.exe (-r|-c) 'target image path' 'output path'
Options
    --record   (-r)    : Recover by record
    --complete (-c)    : Recover by chunk

Examples of usage

EvtxCarv.exe -c c:\\image.raw c:\\output\\
EvtxCarv.exe -r image.raw output

License

DFRC@KU

Feedback

Please submit feedback via the EvtxCarv tracker

Author: Chanung Pak (kkoha@msn.com)