├── .gitattributes ├── .github └── workflows │ └── test.yaml ├── .gitignore ├── LICENSE ├── Makefile ├── README.md ├── bin ├── catalog.go ├── dump_table.go ├── main.go └── page.go ├── docs └── long_value.md ├── fixtures ├── SRUM-D10CA2FE-6FCF-4F6D-848E-B2E99266FA86.golden ├── SYSTEM_IDENTITY.golden ├── UAL_CLIENTS.golden ├── WebCacheV01.dat.golden ├── WindowsEdb.golden ├── WindowsQmgr.golden ├── ntds.dit.golden └── ntds.dit_sd_table.golden ├── go.mod ├── go.sum ├── parser ├── catalog.go ├── compression.go ├── context.go ├── conversion.spec.yaml ├── debug.go ├── ese_gen.go ├── ese_profile.json ├── guid.go ├── long_values.go ├── pages.go ├── reader.go └── utils.go ├── parser_test.go └── testdata ├── README.md ├── SRUM └── SRUDB.dat ├── Sample_UAL ├── HyperV-PC │ ├── Current.mdb │ ├── Information.txt │ ├── SystemIdentity.mdb │ └── {03A01CC5-91BB-4936-B685-63697785D39E}.mdb └── Nondomain-User │ ├── Current.mdb │ ├── Information.txt │ ├── SystemIdentity.mdb │ └── {03A01CC5-91BB-4936-B685-63697785D39E}.mdb └── Samples ├── WebCacheV01.dat ├── Windows.edb ├── ntds.dit └── qmgr.db /.gitattributes: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/.gitattributes -------------------------------------------------------------------------------- /.github/workflows/test.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/.github/workflows/test.yaml -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/.gitignore -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/LICENSE -------------------------------------------------------------------------------- /Makefile: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/Makefile -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/README.md -------------------------------------------------------------------------------- /bin/catalog.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/bin/catalog.go -------------------------------------------------------------------------------- /bin/dump_table.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/bin/dump_table.go -------------------------------------------------------------------------------- /bin/main.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/bin/main.go -------------------------------------------------------------------------------- /bin/page.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/bin/page.go -------------------------------------------------------------------------------- /docs/long_value.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/docs/long_value.md -------------------------------------------------------------------------------- /fixtures/SRUM-D10CA2FE-6FCF-4F6D-848E-B2E99266FA86.golden: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/fixtures/SRUM-D10CA2FE-6FCF-4F6D-848E-B2E99266FA86.golden -------------------------------------------------------------------------------- /fixtures/SYSTEM_IDENTITY.golden: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/fixtures/SYSTEM_IDENTITY.golden -------------------------------------------------------------------------------- /fixtures/UAL_CLIENTS.golden: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/fixtures/UAL_CLIENTS.golden -------------------------------------------------------------------------------- /fixtures/WebCacheV01.dat.golden: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/fixtures/WebCacheV01.dat.golden -------------------------------------------------------------------------------- /fixtures/WindowsEdb.golden: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/fixtures/WindowsEdb.golden -------------------------------------------------------------------------------- /fixtures/WindowsQmgr.golden: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/fixtures/WindowsQmgr.golden -------------------------------------------------------------------------------- /fixtures/ntds.dit.golden: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/fixtures/ntds.dit.golden -------------------------------------------------------------------------------- /fixtures/ntds.dit_sd_table.golden: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/fixtures/ntds.dit_sd_table.golden -------------------------------------------------------------------------------- /go.mod: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/go.mod -------------------------------------------------------------------------------- /go.sum: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/go.sum -------------------------------------------------------------------------------- /parser/catalog.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/parser/catalog.go -------------------------------------------------------------------------------- /parser/compression.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/parser/compression.go -------------------------------------------------------------------------------- /parser/context.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/parser/context.go -------------------------------------------------------------------------------- /parser/conversion.spec.yaml: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/parser/conversion.spec.yaml -------------------------------------------------------------------------------- /parser/debug.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/parser/debug.go -------------------------------------------------------------------------------- /parser/ese_gen.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/parser/ese_gen.go -------------------------------------------------------------------------------- /parser/ese_profile.json: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/parser/ese_profile.json -------------------------------------------------------------------------------- /parser/guid.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/parser/guid.go -------------------------------------------------------------------------------- /parser/long_values.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/parser/long_values.go -------------------------------------------------------------------------------- /parser/pages.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/parser/pages.go -------------------------------------------------------------------------------- /parser/reader.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/parser/reader.go -------------------------------------------------------------------------------- /parser/utils.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/parser/utils.go -------------------------------------------------------------------------------- /parser_test.go: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/parser_test.go -------------------------------------------------------------------------------- /testdata/README.md: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/testdata/README.md -------------------------------------------------------------------------------- /testdata/SRUM/SRUDB.dat: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/testdata/SRUM/SRUDB.dat -------------------------------------------------------------------------------- /testdata/Sample_UAL/HyperV-PC/Current.mdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/testdata/Sample_UAL/HyperV-PC/Current.mdb -------------------------------------------------------------------------------- /testdata/Sample_UAL/HyperV-PC/Information.txt: -------------------------------------------------------------------------------- 1 | This folder contains sample UAL data from "HyperV-PC" 2 | -------------------------------------------------------------------------------- /testdata/Sample_UAL/HyperV-PC/SystemIdentity.mdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/testdata/Sample_UAL/HyperV-PC/SystemIdentity.mdb -------------------------------------------------------------------------------- /testdata/Sample_UAL/HyperV-PC/{03A01CC5-91BB-4936-B685-63697785D39E}.mdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/testdata/Sample_UAL/HyperV-PC/{03A01CC5-91BB-4936-B685-63697785D39E}.mdb -------------------------------------------------------------------------------- /testdata/Sample_UAL/Nondomain-User/Current.mdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/testdata/Sample_UAL/Nondomain-User/Current.mdb -------------------------------------------------------------------------------- /testdata/Sample_UAL/Nondomain-User/Information.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/testdata/Sample_UAL/Nondomain-User/Information.txt -------------------------------------------------------------------------------- /testdata/Sample_UAL/Nondomain-User/SystemIdentity.mdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/testdata/Sample_UAL/Nondomain-User/SystemIdentity.mdb -------------------------------------------------------------------------------- /testdata/Sample_UAL/Nondomain-User/{03A01CC5-91BB-4936-B685-63697785D39E}.mdb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/testdata/Sample_UAL/Nondomain-User/{03A01CC5-91BB-4936-B685-63697785D39E}.mdb -------------------------------------------------------------------------------- /testdata/Samples/WebCacheV01.dat: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/testdata/Samples/WebCacheV01.dat -------------------------------------------------------------------------------- /testdata/Samples/Windows.edb: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/testdata/Samples/Windows.edb -------------------------------------------------------------------------------- /testdata/Samples/ntds.dit: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/testdata/Samples/ntds.dit -------------------------------------------------------------------------------- /testdata/Samples/qmgr.db: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Velocidex/go-ese/HEAD/testdata/Samples/qmgr.db --------------------------------------------------------------------------------