Closed janstarke closed 2 years ago
I reimplemented evtxgrep based on this PR, to see if everything works as expected. I like the current approach :-)
@omerbenamram @forensicmatt: I added an additional use case, which I needed during a project of mine: https://github.com/janstarke/evtx2bodyfile
This tools creates a bodyfile from Windows Event logs. I'm looking forward to positive feedback from you regarding this very PR.
Regards, Jan
A better approach then returning some general structure is to call a custom visitor while traversing an event record. This implementation provides an interface for this. One can use this to construct any structure, as needed. In detail, this visitor adapts an internal visitor and hides all internal types.
Usage example:
I used evtxgrep as PoC to see if everything works as desired, keep as much changes as possible outside of
evtx