nwf9

Use memtriage

1

Hi Diogo, Use memtriage to grab all the relevant info without dumping memory.

Parsing error

12

Hi Willi, You will find below the traceback i met with the last release. Scenario : Windows 2008 traceback evtxtract : ``` evtxtract raw_image.001 > evtxcarving.xml INFO:evtxtract.carvers:Unknown exception processing record...

Add Syscache.hve artifact

2

Hi Matias, Do you have plan to add the parsing and analysis for the syscache.hve. You can look into David Cowen research below https://www.hecfblog.com/2018/12/daily-blog-573-forensic-lunch-test.html?m=1

Amcache Parser

7

Hi guys, Amcache parser did not works because of the new structure. Can you update the parser ? Regards