flog

README

flog

Log forensic artifacts as JSON in ECS format.

go install github.com/cuhsat/flog@latest

Usage

$ flog [-pqhv] [-D DIRECTORY] [FILE ...]

Available options:

• -D Log directory
• -p Pretty JSON
• -q Quiet mode
• -h Show usage
• -v Show version

Required system commands:

• dotnet

Use scripts/eztools.sh to install Eric Zimmerman's Tools.

Artifacts

Supported artifacts for Windows 7+ systems:

• System Event Logs
• User JumpLists
• User ShellBags
• User Browser Histories

License

Released under the MIT License.

Documentation

Overview

Log forensic artifacts as JSON in ECS format.

Usage:

flog [-pqhv] [-D DIR] [FILE ...]

The flags are:

 -D directory
    The log directory.
 -p
	Pretty JSON.
 -q
	Quiet mode.
 -h
	Show usage.
 -v
	Show version.

The arguments are:

 file
	The event log file(s) to process.
	Defaults to STDIN if not given.