EvtxECmd version 0.6.5.0

Author: Eric Zimmerman ([email protected])
https://github.com/EricZimmerman/evtx

        d               Directory to process that contains evtx files. This or -f is required
        f               File to process. This or -d is required

        csv             Directory to save CSV formatted results to.
        csvf            File name to save CSV formatted results to. When present, overrides default name
        json            Directory to save JSON formatted results to.
        jsonf           File name to save JSON formatted results to. When present, overrides default name
        xml             Directory to save XML formatted results to.
        xmlf            File name to save XML formatted results to. When present, overrides default name

        dt              The custom date/time format to use when displaying time stamps. Default is: yyyy-MM-dd HH:mm:ss.fffffff
        inc             List of Event IDs to process. All others are ignored. Overrides --exc Format is 4624,4625,5410
        exc             List of Event IDs to IGNORE. All others are included. Format is 4624,4625,5410
        sd              Start date for including events (UTC). Anything OLDER than this is dropped. Format should match --dt
        ed              End date for including events (UTC). Anything NEWER than this is dropped. Format should match --dt
        fj              When true, export all available data when using --json. Default is FALSE.
        tdt             The number of seconds to use for time discrepancy detection. Default is 1 second
        met             When true, show metrics about processed event log. Default is TRUE.

        maps            The path where event maps are located. Defaults to 'Maps' folder where program was executed

        vss             Process all Volume Shadow Copies that exist on drive specified by -f or -d . Default is FALSE
        dedupe          Deduplicate -f or -d & VSCs based on SHA-1. First file found wins. Default is TRUE

        sync            If true, the latest maps from https://github.com/EricZimmerman/evtx/tree/master/evtx/Maps are downloaded and local maps updated. Default is FALSE

        debug           Show debug information during processing
        trace           Show trace information during processing


Examples: EvtxECmd.exe -f "C:\Temp\Application.evtx" --csv "c:\temp\out" --csvf MyOutputFile.csv
          EvtxECmd.exe -f "C:\Temp\Application.evtx" --csv "c:\temp\out"
          EvtxECmd.exe -f "C:\Temp\Application.evtx" --json "c:\temp\jsonout"

          Short options (single letter) are prefixed with a single dash. Long commands are prefixed with two dashes