Closed janstarke closed 1 year ago
This PR provides a generic access to the parsed evtx structure, without a need to parse json (which would make everything very slow)
Usage example:
struct MySpecialEvtxDataStructure {} struct MyVisitor {} impl EvtxStructureVisitor for MyVisitor { type VisitorResult = Option<MySpecialEvtxDataStructure>; /* ... */ } /* ... */ let records = parser.records_to_visitor(|| MyVisitor::new());
I used evtxgrep as PoC to see if everything works as desired, keep as much changes as possible outside of evtx
evtx
I also use this in https://github.com/janstarke/evtx2bodyfile
Another PoC is https://github.com/janstarke/evtx2bodyfile, which I use regularly in forensic investigations
This PR provides a generic access to the parsed evtx structure, without a need to parse json (which would make everything very slow)
Usage example:
I used evtxgrep as PoC to see if everything works as desired, keep as much changes as possible outside of
evtx
I also use this in https://github.com/janstarke/evtx2bodyfile