Python based tool to extract forensic info from EventTranscript.db (Windows Diagnostic Data)

Last update: Nov 18, 2022

Overview

EventTranscriptParser

EventTranscriptParser is python based tool to extract forensically useful details from EventTranscript.db (Windows Diagnostic Database).

The database is found in Windows 10 systems and present at C:\ProgramData\Microsoft\Diagnosis\EventTranscript\EventTranscript.db.

The tool currently supports the following features.

Extracting MS Edge browser history.
Extracting list of software/programs installed on the host system.
Extracting Wireless Scan results.
Extracting WiFi connection details (SSIDs, device manufacturers etc...)
Extracting Physical Disk information (Disk size, No. of partitions etc...)
Extracting PnP device installation information (Install time, Model, Manufacturer etc...)
MORE COMING SOON!!

Requirements

Python 3.8 or above. The older versions of Python 3.x should work fine as well.

Dependencies

These are the required libraries/modules needed to run the script

json
sqlite3
pandas
os
argparse

Usage

The tool is completely CLI based.

python EventTranscriptParser.py -f <Path-To-EventTranscript.db>

Tip: Before running the tool against the database, make sure that the -wal (Write Ahead Log) file data is merged with the original database. Because you might miss out on crucial/juicy data.

Acknowledgements

This tool wouldn't have been possible without the excellent research & hard work put in by my colleagues Andrew Rathbun & Josh Mitchell in investigating the Windows Diagnostic Data.

Read more about their research here - https://github.com/rathbuna/EventTranscript.db-Research

Follow the investigative series at Kroll on EventTranscript.db - https://www.kroll.com/en/insights/publications/cyber/forensically-unpacking-eventtranscript

Author

Abhiram Kumar

Twitter: @_abhiramkumar
Personal blog: https://stuxnet999.github.io

Extract XML from the OS X dictionaries.

13 Dec 11, 2022

Program to extract signatures from documents.

Extracting Signatures from Bank Checks Introduction Ahmed et al. [1] suggest a connected components-based method for segmenting signatures in document

9 Jan 26, 2022

extract gene TSS/TES site form gencode/ensembl/gencode database GTF file and export bed format file.

GetTsite python Package extract gene TSS/TES site form gencode/ensembl/gencode database GTF file and export bed format file. Install $ pip install Get

7 Nov 21, 2022

pydsinternals - A Python native library containing necessary classes, functions and structures to interact with Windows Active Directory.

pydsinternals - Directory Services Internals Library A Python native library containing necessary classes, functions and structures to interact with W

36 Dec 14, 2022

WindowsDebloat - Windows Debloat with python

Windows Debloat 🗑️ Quickly and easily configure Windows 10. Disclaimer I am NOT

1 Mar 26, 2022

Keval allows you to call arbitrary Windows kernel-mode functions from user mode, even (and primarily) on another machine.

Keval Keval allows you to call arbitrary Windows kernel-mode functions from user mode, even (and primarily) on another machine. The user mode portion

42 Dec 17, 2022

Releases(v1.0)

v1.0(Sep 16, 2021)

This release contains the executable - EventTranscriptParser.exe. For more details visit - https://github.com/stuxnet999/EventTranscriptParser#using-executable

Download the file EventTranscriptParser.zip to get only the standalone executable.
Source code(tar.gz)
Source code(zip)
EventTranscriptParser.zip(27.21 MB)

Python based tool to extract forensic info from EventTranscript.db (Windows Diagnostic Data)

Related tags

Overview

EventTranscriptParser

Requirements

Dependencies

Usage

Acknowledgements

Author

You might also like...

Extract XML from the OS X dictionaries.

Program to extract signatures from documents.

extract gene TSS/TES site form gencode/ensembl/gencode database GTF file and export bed format file.

pydsinternals - A Python native library containing necessary classes, functions and structures to interact with Windows Active Directory.

WindowsDebloat - Windows Debloat with python

Keval allows you to call arbitrary Windows kernel-mode functions from user mode, even (and primarily) on another machine.

Group imports from Windows binaries

🚧Useful shortcuts for simple task on windows

SH-PUBLIC is a python based cloning script. You can clone unlimited UID facebook accounts by using this tool.

Releases(v1.0)

v1.0(Sep 16, 2021)

Owner

P. Abhiram Kumar

Local backup made easy, with Python and shutil

Creates a C array from a hex-string or a stream of binary data.

Dependency injection lib for Python 3.8+

Python program for Linux users to change any url to any domain name they want.

An online streamlit development platform

✨ Voici un code en Python par moi, et en français qui permet d'exécuter du Javascript en Python.

Report Bobcat Status to Google Sheets

Modest utility collection for development with AIOHTTP framework.

Audio Steganography is a technique used to transmit hidden information by modifying an audio signal in an imperceptible manner.

A collection of tools for biomedical research assay analysis in Python.

Python humanize functions

More routines for operating on iterables, beyond itertools

Shypan, a simple, easy to use, full-featured library written in Python.

一款不需要买代理来减少扫网站目录被封概率的扫描器，适用于中小规格字典。

This tool lets you perform some quick tasks for CTFs and Pentesting.

✨ Un chois aléatoire d'un article sur Wikipedia totalement fait en Python par moi, et en français.

Skywater 130nm Klayout Device Generators PDK

A python lib for generate random string and digits and special characters or A combination of them

Create password - Generate Random Password with Passphrase

one_click_kag_server is a program which tries to fully automate the creation of a King Arthur's Gold server.