Parse::Evtx - parses a Microsoft Windows Vista event log file (.evtx)
use Parse::Evtx; # create an object for your event log file my $fh = IO::File->new('Application.evtx', "r"); # create a parser object my $parser = Parse::Evtx->new('FH' => $fh);
# iterate through all event records my $event = $parser->get_first_event(); while (defined $event) { print $event->get_xml(); $event = $file->get_next_event(); }; # all done, close the file handle $fh->close(); =head1 DESCRIPTION
Microsoft Windows Vista records events in a proprietary binary file format. An object of this class represents a parser for a Vista event log file. The main purpose of this modules is to translate event log files from their native binary form into textual XML.
The Evtx object instantiates chunk objects as needed.
This is the constructor for the parser class.
This is a handle object for the event log file. The object is required to be a descendant of IO::File.
This method checks the file for certain errors and marks them in a return code. Right now, only the CRC32 check of the file header is implemented.
This method returns a pointer to the current Parse::Evtx::Chunk object.
This method retrieves the first chunk from a file. A prior call to
get_first_chunk must have succeeded. The method then returns a
Parse::Evtx object on success and undef
on failure. Note, that
get_first_chunk changes the file pointer in the associated file handle object.
A pointer to the chunk object is stored in the Evtx object and can be
retrieved by calling get_current_chunk.
This method retrieves the next chunk from a file. It returns a
Parse::Evtx object on success and undef
on failure. Note, that
get_next_chunk changes the file pointer in the associated file handle object.
A pointer to the chunk object is stored in the Evtx object and can be
retrieved by calling get_current_chunk.
This method retrieves the first event record from a file. It returns a
Parse::Evtx::Event object on success and undef
on failure. Note that
get_first_event changes the file pointer in the associated file handle object.
As a side effect the method will instantiate the first chunk object.
This method retrieves the next event record from a file. It returns a
Parse::Evtx::Event object on success and undef
on failure. Note that
get_next_event changes the file pointer in the associated file handle object.
The methods loads new chunks as needed.
new returns undef
, if it doesn't recognize the format of the file.
If you are attempting to parse a single chunk from a corrupted file, then
create an instance of Parse::Evtx::Chunk instead.
Other errors will be signalled through assertions and make the parser die()
.
This module depends on the following non-standard modules, which are not part of this package:
Log2t::input::evt, Log2t::input::urlsnarf, Log2t::input::firefox2, Parse::Evtx::BXmlNode::Node0x04, Log2t::input::pdf, dev::template_for_input_module_logfile, Log2t::input::proftpd_xferlog, Log2t::input::volatility, Log2t::input::mssql_errlog, Parse::Evtx::Const, Parse::Evtx::VariantType::Type0x04, Log2t::input::analog_cache, Parse::Evtx::VariantType::Type0x08, Parse::Evtx::VariantType::Type0x0e, Parse::Evtx::Chunk, Log2t::input::apache2_access, Log2t::output::beedocs, Log2t::input::mft, Parse::Evtx::VariantType::Type0x03, Log2Timeline, Parse::Evtx::BXmlNode::SubstArray, Parse::Evtx::VariantType::Type0x05, Parse::Evtx::BXmlNode::Node0x01, Log2t::input::symantec, Log2t::input::firefox3, Log2t::input::isatxt, Log2t::output::mactime_l, Parse::Evtx::VariantType::Type0x0d, Log2t::output::tab, Log2t::BinRead, Parse::Evtx::BXmlNode::Node0x05, Log2t::output::tln, Log2t::output::cef, Parse::Evtx::BXmlNode::NameString, Log2t::input::xpfirewall, Log2t::input::opera, Log2t::input::iis, Log2t::input::oxml, Log2t::input::win_link, Log2t::Time, Parse::Evtx::VariantType::Type0x09, Parse::Evtx::VariantType::Type0x12, Log2t::input::altiris, Parse::Evtx::VariantType::Type0x15, Log2t::input::pcap, Log2t::input::exif, Log2t::input::mcafee, Parse::Evtx::VariantType::Type0x95, Parse::Evtx::VariantType::Type0x94, Log2t::PreProc::user_browser, Log2t::input::recycler, Log2t::input::openvpn, Parse::Evtx::VariantType::Type0x0c, Log2t::output::simile, Log2t::input::mactime, Parse::Evtx::VariantType::Type0x13, Parse::Evtx, Log2t::input::evtx, Parse::Evtx::VariantType, Log2t::input::tln, Parse::Evtx::BXmlNode, Log2t::base::input, Parse::Evtx::VariantType::Type0x21, Parse::Evtx::VariantType::Type0x0f, Parse::Evtx::BXmlNode::Node0x0d, Parse::Evtx::BXmlNode::Node0x0c, Log2t::Numbers, Parse::Evtx::VariantType::Type0x06, Log2t::output::csv, Log2t::input::skype_sql, Log2t::input::l2t_csv, Log2t::input::squid, Log2t::input::security, Parse::Evtx::BXmlNode::Root, Log2t::input::apache2_error, Log2t::input::ftk_dirlisting, Parse::Evtx::BXmlNode::Template, Parse::Evtx::BXmlNode::Node0x0f, Log2t::output::cftl, Parse::Evtx::VariantType::Type0x01, Log2t::input::software, Parse::Evtx::VariantType::Type0x0b, dev::template_for_output_module, Log2t::input::iehistory, Parse::Evtx::VariantType::Type0x07, Log2t::input::restore, Log2t::input::sam, Parse::Evtx::VariantType::Type0x0a, Parse::Evtx::BXmlNode::Node0x00, Parse::Evtx::VariantType::Type0x14, Parse::Evtx::VariantType::Type0x02, Log2t::input::jp_ntfs_change, Log2t::input::ntuser, Log2t::input::setupapi, Parse::Evtx::VariantType::Type0x81, Parse::Evtx::VariantType::Type0x00, Log2t::input::syslog, Parse::Evtx::VariantType::Type0x11, Parse::Evtx::BXmlNode::Node0x0e, Log2t::WinReg, Log2t::input::mcafeehs, Parse::Evtx::VariantType::Type0x10, Log2t::input::wmiprov, Log2t::input::mcafeehel, Log2t::input::encase_dirlisting, Parse::Evtx::Event, Log2t::Common, Log2t::output::mactime, Log2t::Network, Log2t::input::prefetch, Log2t::input::safari, Log2t::input::generic_linux, Log2t::output::tlnx, Log2t::input::sol, Parse::Evtx::BXmlNode::Node0x03, Log2t::PreProc::win_sysinfo, Parse::Evtx::BXmlNode::Node0x02, Log2t::input::system, Log2t::output::sqlite, dev::chrome_cache, Log2t::Win, Parse::Evtx::BXmlNode::Node0x06, Log2t::input::chrome, Log2t::input::ff_bookmark, Log2t::input::ff_cache, Log2t::input::mcafeefireup
Source Code: Parse::Evtx
Andreas Schuster (schuster@cpan.org)
This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version.
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307, USA.