Skip to content

Commit

Permalink
Update README.md
Browse files Browse the repository at this point in the history
  • Loading branch information
yarox24 committed Mar 29, 2016
1 parent 012cbed commit 92cc2a5
Showing 1 changed file with 5 additions and 24 deletions.
29 changes: 5 additions & 24 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,31 +2,12 @@
Fix acquired .evt - Windows Event Log files (Forensics)

## Help
positional arguments:

sources a.evt b.evt evt_dir/


optional arguments:

-h, --help show this help message and exit

-i, --in-place Change .evt in-place (Default)

-c, --copy Create copy of .evt with suffix [NAME]_fixed.evt

-o OUT_DIR, --out-dir OUT_DIR

Output directory for fixed .evt files. Implies -c

-q, --quiet Turn off verbosity

Examples
evtkit v 0.2 (beta) -== https://github.com/yarox24/evtkit ==-
*** Please provide at least one .evt file or directory containing .evt files

Examples:
1. Fix in-place 2 files (Make sure you got a copy!):

evtkit.py AppEvent.Evt SysEvent.Evt

2. Find all *.evt files in logs_dir/, copy them to fixed_copy/ and repair them:

evtkit.py --copy --out-dir=fixed_copy logs_dir
2. Find all *.evt files in evt_dir/, copy them to fixed_copy/ and repair them:
evtkit.py --copy_to_dir=fixed_copy evt_dir

0 comments on commit 92cc2a5

Please sign in to comment.