devgc

Stat Errors on Windows Logical and Physical Drives

3

Errors occur when trying to use a logical (\\\\.\\C:) or physical drive (\\\\.\\PHYSICALDRIVE0) with the SourceScanner. This is due to the handles not having stat objects. Example script to produce...

Exception Message Truncation on Windows

4

On Windows, dfvfs Exceptions can contain messages with returns but without the new line character. This can lead to message truncation when exceptions are thrown. If I run the following...

EVT indexed records should mimic that of EVTX so elastic queries will work between the two.

Create log2timeline style report