Willi Ballenthin

Recover event log entries from an image by heurisitically looking for record structures.

williballenthin

Reconstruct process trees from event logs

williballenthin

Pure Python parser for data encoded by .NET's BinaryFormatter

williballenthin

Pure Python parser for classic Windows Event Log files (.evt)

williballenthin

Pure Python parser and analyzer for IDA Pro database files (.idb).

williballenthin

Open source Python library for NTFS analysis

williballenthin

Pure Python parser for Windows Registry hives.

williballenthin

Pure Python parser for Application Compatibility Shim Databases (.sdb files)

williballenthin

analysis of visual basic code

williballenthin

Cross-platform, open-source shellbag parser

williballenthin