GrokEVT Version 0.4.0

By Andreas Schuster on April 9, 2007 4:00 PM

GrokEVT is a set of Python scripts for reading Windows Event Log files (.evt) on Unix hosts. New in version 0.4.0 is grokevt-findlogs which carves event records from raw binary data like unallocated clusters or a memory dump.