search

0xrawsec / golang-evtx

GNU General Public License v3.0
157 stars 26 forks source link

What exactly does ModeCarving do? #34

Closed CaledoniaProject closed 1 year ago

CaledoniaProject commented 1 year ago

What exactly does ModeCarving do? Can you explain on that?

qjerome commented 1 year ago

Hey @CaledoniaProject,

Sorry for this late reply ... The carving mode is used to retrieve EVTX logs entries in unusual places like (memory dumps, disk images ...). In this mode, we search only for things looking like EVTX chunks and trying to parse it, we do not care about all the EVTX file format.

CaledoniaProject commented 1 year ago

Looks like a useful parameter to me.