grokevt-findlogs(1)

💖 grokevt-findlogs — the grokevt(1) manual page, bestie edition 💖

okay so this is grokevt-findlogs(1), one of the grokevt file conversion utilities, and honestly? it's giving forensic scavenger hunt 🔍✨

---

🎀 NAME 🎀

grokevt-findlogs — attempts to find log file fragments in raw binary files, such as memory dumps and disk images.

like. it goes digging through a giant pile of raw bytes looking for lil pieces of event logs that got left behind. treasure hunt energy, no cap. 👑

---

✨ SYNOPSIS ✨

grokevt-findlogs -?

grokevt-findlogs [-v] [-h] [-H] [-o offset] raw-file

literally just one of those two. the first one is "help me pls", the second one is "do the thing". 🫶

---

🌸 DESCRIPTION 🌸

grokevt-findlogs searches a raw binary file for event log records. it produces a simple comma-separated values (CSV) output to stdout which includes metadata and offsets of any hits.

so you hand it a big ol' blob of raw bytes, and it's like "ooh bestie i found something 👀" and tells you where. using the metadata and offset/contiguity information, it should be easy to determine if the hits are false positives or not.

that last part is important — the tool doesn't judge for you, it just points at stuff and goes "here?? maybe??" and you get to be the main character and decide. 💅

---

🦋 ARGUMENTS 🦋

• raw-file — the binary file to be searched. this is the raw blob getting the vibe check. 💜

---

💅 OPTIONS 💅

• -? — prints a basic usage statement. the "hello?? what do i do??" option. 🌈
• -v — verbose mode. prints status messages to stderr, which can be helpful for debugging. and here's the tea: (currently does nothing.) so yeah, it's aesthetic. 😭
• -h — prints a header row at the top of the CSV output containing labels for each column. this is the default behavior, so it's already slaying without you asking. ✨
• -H — disables the printing of a header row. this is useful when grokevt-findlogs is used in a script, because scripts don't need cute little labels, they just want the data fr fr. 🍓
• -o offset — begin search at this byte offset within the binary file. skip the boring intro, start where the action is. 🔥

---

💀 BUGS 💀

• probably a few. this script has not been extensively tested with some guest platforms. 🙈
• there are likely some speed improvements that could be made. it's not slow exactly, it's just... thinking about it. 🧚

not me telling you about the bugs in my own tool but like. honesty is iconic. 🎀

---

👑 CREDITS 👑

written by Timothy D. Morgan — the og, the blueprint, the moment. ⭐

---

📜 LICENSE 📜

please see the file "LICENSE" included with this software distribution.

this program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. see the GNU General Public License version 3 for more details.

okay so that's the legal-speak version of "i'm handing you this for free, please don't come for me if it breaks." 😭💖

---

🌈 SEE ALSO 🌈

grokevt(7) grokevt-addlog(1) grokevt-builddb(1) grokevt-dumpmsgs(1) grokevt-parselog(1) grokevt-ripdll(1)

the whole friend group. go say hi. 🫶

---

file conversion utilities, 20 June 2011 — yeah this page is a lil vintage but it still ate, and it's still grokevt-findlogs(1) at heart. periodt. 💖✨