grokevt-findlogs1
Attempts to find log file fragments in raw binary files, such as memory dumps and disk images.
Usage
grokevt-findlogs -?
grokevt-findlogs [-v]
[-h]
[-H]
[-o
offset]
raw-file
Overview
grokevt-findlogs searches a raw binary file for event log records. It produces a simple comma-separated values (CSV) output to stdout which includes metadata and offsets of any hits. Using the metadata and offset/contiguity information, it should be easy to determine if the hits are false positives or not.
Arguments
- raw-file
-
The binary file to be searched.
Options
- FC
-?F[0] -
Prints a basic usage statement.
- FC
-vF[0] -
Verbose mode. Prints status messages to stderr, which can be helpful for debugging. (Currently does nothing.)
- FC
-hF[0] -
Prints a header row at the top of the CSV output containing labels for each column. (This is the default behavior.)
- FC
-HF[0] -
Disables the printing of a header row. This is useful when grokevt-findlogs is used in a script.
- FC-o F[0]offset
-
Begin search at this byte offset within the binary file.
Credits
Written by Timothy D. Morgan
Releases
9 releases since Debian 5.0 (Lenny); the text changed 2 times.