Windows Event Log message strings support
For those of you following log2timeline-dev@ you might already know that the development version of plaso now has support to output Windows Event Log message strings. So now instead of having to rely on other tools or manually looking up every event identifier on eventid.net you can enjoy having full Windows Event log message strings in your timeline. How to use The message strings are generated in the formatting phase, hence run log2timeline.py as you did before: log2timeline.py storage.plaso Security.evtx But things are different when you run psort.py e.g.: log2timeline.py storage.plaso Before the Windows Event Log message strings support: 2012-03-14T08:13:44.905177+00:00,Content Modification Time,EVT,WinEVTX,[7040 / 0x1b80] Record Number: 12064 Event Level: 4 Source Name: Service Control Manager Computer Name: WKS-WIN764BITB.shieldbase.local Strings: ['Windows Modules Installer' 'auto start' 'demand start' 'TrustedInstaller'],winevtx,OS:/Test/Sys...