evtx
evtx copied to clipboard
Any options to exclude the record # and xml version lines?
Hi Great tool! Is there an option to exclude the following lines from the output files?
Record ######
<?xml version="1.0" encoding="utf-8"?>
Thanks
Same question but for -o json output...
#207 looks like it fixes the JSON issue related to the record number
Haven't tested the PR, but I'm having to replace the "record number" lines with a "," and wrapping everything with [] to get it to parse in jq correctly.