Provided by: grokevt_0.4.1-7_all bug


       GrokEVT  -  a collection of scripts built for reading windows event log


       This document serves as an overview  to  using  the  GrokEVT  suite  of
       tools. Please see the man pages for each tool for specific command-line


       Using GrokEVT on a set of windows partitions is a three stage  process.
       One must first mount the partitions and configure the system's profile.
       Next,  grokevt-builddb(1)  must  be  run  to  extract   the   necessary
       information from these partitions.  Finally, grokevt-parselog(1) may be
       run to use this information to convert the logs to something useful.

       Mounting and configuration:

       This is the most labor-intensive step of the process. There are several
       technical  reasons  why this cannot be simpler, and it is unlikely many
       will be resolved anytime soon. (Sorry, blame the  vendor  who  produced
       these logs that you wish to convert.)

       First  mount the partitions used by your windows system.  Specifically,
       mount any partition  that  has  software  installed  on  it.  (You  can
       probably  get  away  with  not  mounting  ones  with no software, or no
       software that produces events in the event log.)  This includes windows
       shares, if you have any with software installed on them.

       The  key  point  when  mounting  partitions or shares, is that you must
       mount them with case-insensitive filenames. To do this  in  Linux,  you
       should be able to use the NTFS option 'posix=0', or with type vfat this
       appears to be the default. On FreeBSD, one can use the -i  option  with
       NTFS  and  mount_ntfs,  but  this hasn't been tested. (More research is
       necessary in this area. Please let me  know  if  case-insensitivity  is
       available  on  other  *NIXes and what the options are.) All of this, of
       course, depends on your version of  mount  and  related  software.  See
       mount(8) for more information.

       Once you have all necessary filesystems mounted for your windows image,
       you need to configure GrokEVT so it knows where everything is.  If  you
       look   in   the   main   configuration   directory,   (by   default  at
       '/usr/local/etc/grokevt') you'll find a sub-directory called 'systems'.
       In  there  is  a  set  of system configuration profiles. Each directory
       under 'systems' represents the configuration for a single windows host.
       You  may  create  directories here of any name. It is suggested you use
       the host name of the system you wish to extract logs from.

       By default, there will be one system configuration there already, named
       'example'.  I  suggest  you  make a full copy of this, and edit it from
       there to create your own configuration:

              # cd /usr/local/etc/grokevt/systems
              # cp -r example mysystem

       Now that you have your own configuration, take  a  look  at  the  files
       under this directory:


       Each  file represents a single configuration setting. The first line of
       every file is the setting, all others are ignored. You should start  by
       configuring  your drive letters. These drive letters need to map to the
       *NIX path of the drives. So, if you mounted  your  C:  partition  under
       '/mnt/win/c', then you should do the following:

              echo /mnt/win/c > drives/c:

       This  will  of course, overwrite that file with your actual mount point
       for the C: drive. Do this  for  all  drives  mounted  on  your  windows

       Next, you need to configure your %SystemRoot% path variable.  Since the
       registry often references files in relation to this variable,  we  need
       to  know  where it is on your system.  Typically, on W2K this should be
       'C:\WINNT'. On other windows systems it  is  often  'C:\Windows'.  This
       path  may  be referenced as a full windows path (with drive letters) or
       as a *NIX path.

       Finally, you need to set the path of the  system  registry.  This  path
       must be a *NIX path, and not a windows path. It should be located under
       your %SystemRoot%. For instance, if you mount a  W2K  machine's  C:  on
       '/mnt/win/c',       this       path       will       probably       be:

       This will vary from system to system, but if you  have  ever  done  any
       forensics, you should be able to find the correct path pretty quickly.

       Using grokevt-builddb(1):

       Once  you  get past the mounting and configuration step, you're in good
       shape. To extract the necessary information from the  system  you  just
       mounted,  you  just  need  to decide where you want to store the output
       database. Based on the example paths  above,  one  could  run  grokevt-
       builddb(1) like so:

              grokevt-builddb mysystem /var/db/grokevt/mysystem

       Or  something similar. This step will take some time, as a lot of files
       need to be parsed. You will likely get some warnings about missing DLLs
       and  possibly  service  removals.  This  is  normal  if software on the
       windows system failed to clean up the registry correctly  when  it  was
       un-installed.  You  might  want  to  record this information though, if
       later you find you are missing a lot of message templates in  your  log

       Now  that  you  have  finished  this step, you have fully extracted all
       information needed to interpret the event logs.

       Using grokevt-parselog(1):

       To run grokevt-parselog(1), you must  specify  the  database  directory
       that you generated with grokevt-builddb(1). Initially, you will want to
       find out what event logs were extracted by running:

              grokevt-parselog -l /var/db/grokevt/mysystem

       This will print out all available event log types, based on information
       found  previously  in  the  system's registry. Then you may view one of
       those logs simply by dropping the -l option, and adding  it's  name  as
       the second parameter. For instance, to view the 'System' log:

              grokevt-parselog /var/db/grokevt/mysystem System

       See the grokevt-parselog(1) man page for further options.

       Finding and Parsing Log Fragments:

       One  may  find it useful to parse deleted log files or fragments of log
       files found in a system's RAM dump. A  special-purpose  tool,  grokevt-
       findlogs(1)  is  included  in this distribution which makes finding log
       fragments easy. It can find even a single log record by itself  with  a
       relatively low rate of false positives.

       Suppose one has a file, dump.img, which contains an image of a system's
       RAM, or perhaps the unallocated blocks of a  filesystem  (as  might  be
       produced  by  The  SleuthKit's  dls(1)).  One could search this dump by

              grokevt-findlogs dump.img

       This will produce a listing of all hits in the file, which may  include
       header  records, cursor records, or log records, offsets and contiguity
       information to help one eliminate any false positives.

       Supposing we found a log fragment in this dump  that  we're  interested
       in,  we  could  simply  use  dd(1)  or some other tool to carve out the
       relevant data in to a file named fragment.evt. We'd then need to find a
       way  to  associate  this  log with a set of message templates.  This is
       what grokevt-addlog(1) is for. Let's take a guess that the fragment.evt
       was  originally  a  part  of  System log. We would add the log into our
       previously built message database by running:

              grokevt-addlog /var/db/grokevt/mysystem fragment.evt System-fragment System

       Finally, we can parse the log by simply specifying the  newly  imported
       name with grokevt-parselog(1):

              grokevt-parselog /var/db/grokevt/mysystem System-fragment

       If we found that most of the log entries didn't have associated message
       templates (which would result in lots of warnings to stderr), we  would
       be pretty that fragment.evt really wasn't based on a System log. Simply
       re-importing it as another log type (and a different name) would let us
       parse it again as if it were of another type.

       Please  see the grokevt-findlogs(1) and grokevt-addlog(1) man pages for
       more information.


       This man page written by Timothy D. Morgan


       Please see the file "LICENSE" included with this software distribution.

       This program is distributed in the hope that it  will  be  useful,  but
       WITHOUT   ANY   WARRANTY;   without   even   the  implied  warranty  of
       General Public License version 2 for more details.


       grokevt-addlog(1)   grokevt-builddb(1)   grokevt-findlogs(1)   grokevt-
       parselog(1) grokevt-ripdll(1) reglookup(1)