NAME

xr - experimental record analyzer

SYNOPSIS

$ cat FILE | xr | uniq | sort

DESCRIPTION

xr is an experimental fast event record analyzer for forensic triaging. It targets to answer two main questions about event logs: WHAT and WHEN did it happen? Contrary to existing tools, it tries to answer these questions by analyzing the raw event record structure, rather than parsing whole event log chunks. By reading from any input stream, xr is capable of carving raw forensic disk images and memory dumps.

INSTALLATION

$ go install go.foxforensics.dev/xr@latest

REFERENCES

• Introducing the Microsoft Vista event log file format - Schuster, Andreas
• Windows XML Event Log (EVTX) format - Metz, Joachim

SEE ALSO

dd(1), cat(1), uniq(1), sort(1)