search

cisagov / CHIRP

A DFIR tool written in Python.
Creative Commons Zero v1.0 Universal
1.04k stars 90 forks source link

No dynamic pathing for events plugin #1

Closed DeemOnSecurity closed 3 years ago

DeemOnSecurity commented 3 years ago

🐛 Summary

Events plugin does not dynamically path to the winevts folder, but searches for the winevts folder in the current directory.

To reproduce

Steps to reproduce the behavior:

  1. Run chirp from a drive without winevts.

Expected behavior

CHIRP should search all available drives for a valid winevts folder.