https://github.com/EricZimmerman/RecentFileCacheParser

Parses RecentFileCacheParser.bcf files
https://github.com/EricZimmerman/RecentFileCacheParser

Last synced: 3 months ago
JSON representation

Parses RecentFileCacheParser.bcf files

• Host: GitHub
• URL: https://github.com/EricZimmerman/RecentFileCacheParser
• Owner: EricZimmerman
• License: mit
• Created: 2018-01-19T19:27:07.000Z (almost 7 years ago)
• Default Branch: master
• Last Pushed: 2023-07-07T16:03:20.000Z (over 1 year ago)
• Last Synced: 2024-05-01T21:21:39.157Z (6 months ago)
• Language: C#
• Size: 138 KB
• Stars: 24
• Watchers: 7
• Forks: 10
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• Awesome-KAPE - RecentFileCacheParser

README

        
# RecentFileCacheParser

## Command Line Interface

    RecentFileCacheParser version 1.0.0.0

    

    Author: Eric Zimmerman ([email protected])

    https://github.com/EricZimmerman/RecentFileCacheParser

    

            f               File to process. Required

            q               Only show the filename being processed vs all output. Useful to speed up exporting to json and/or csv

    

            csv             Directory to save CSV formatted results to. Be sure to include the full path in double quotes

            csvf            File name to save CSV formatted results to. When present, overrides default name

            json            Directory to save json representation to. Use --pretty for a more human readable layout

            pretty          When exporting to json, use a more human readable layout

    

    

    Examples: RecentFileCacheParser.exe -f "C:\Temp\RecentFileCache.bcf" --csv "c:\temp"

              RecentFileCacheParser.exe -f "C:\Temp\RecentFileCache.bcf" --json "D:\jsonOutput" --jsonpretty

    

              Short options (single letter) are prefixed with a single dash. Long commands are prefixed with two dashes

## Documentation

Parses RecentFileCacheParser.bcf files.

# Download Eric Zimmerman's Tools

All of Eric Zimmerman's tools can be downloaded [here](https://ericzimmerman.github.io/#!index.md). Use the [Get-ZimmermanTools](https://f001.backblazeb2.com/file/EricZimmermanTools/Get-ZimmermanTools.zip) PowerShell script to automate the download and updating of the EZ Tools suite. Additionally, you can automate each of these tools using [KAPE](https://www.kroll.com/en/services/cyber-risk/incident-response-litigation-support/kroll-artifact-parser-extractor-kape)!

# Special Thanks

Open Source Development funding and support provided by the following contributors: [SANS Institute](http://sans.org/) and [SANS DFIR](http://dfir.sans.org/).