Package: prefetch2es
prefetch2esFast import of Windows Prefetch(.pf) into Elasticsearch.prefetch2es uses C librarylibscca.UsageWhen using from the commandline interface:$prefetch2es/path/to/your/file.pfWhen using from the python-script:fromprefetch2es.prefetch2esimportprefetch2esif__name__=='__main__':filepath='/path/to/your/file.pf'prefetch2es(filepath)Argumentsprefetch2es supports importing from multiple files.$ prefetch2es file1.pf file2.pf file3.pfAlso, possible to import recursively from a specific directory.$ tree .
pffiles/
  ├── file1.pf
  ├── file2.pf
  ├── file3.pf
  └── subdirectory/
    ├── file4.pf
    └── subsubdirectory/
      ├── file5.pf
      └── file6.pf

$ prefetch2es /pffiles/ # The Path is recursively expanded to file1~6.pf.Options--host: 
    ElasticSearch host address
    (default: localhost)

--port: 
    ElasticSearch port number
    (default: 9200)

--index: 
    Index name
    (default: prefetch2es)

--scheme:
  Scheme to use (http, or https)
  (default: http)

--pipeline
  Elasticsearch Ingest Pipeline to use
  (default: )

--login:
  The login to use if Elastic Security is enable
  (default: )

--pwd:
  The password linked to the login provided
  (default: )ExamplesWhen using from the commandline interface:$ prefetch2es /path/to/your/file.pf --host=localhost --port=9200 --index=foobarWhen using from the python-script:if__name__=='__main__':prefetch2es('/path/to/your/file.pf',host=localhost,port=9200,index='foobar')With the Amazon Elasticsearch Serivce (ES):$ prefetch2es /path/to/your/file.pf --host=example.us-east-1.es.amazonaws.com --port=443 --scheme=https --index=foobarWith credentials for Elastic Security:$ prefetch2es /path/to/your/file.pf --host=localhost --port=9200 --index=foobar --login=elastic --pwd=******Note: The current version does not verify the certificate.Supported Prefetch versionsWindows XPWindows 2003Windows Vista (SP0)Windows 7 (SP0)Windows 8.1Windows 10 1809Windows 10 1903For more information, please visitlibscca.Appendixprefetch2jsonExtra feature. 🍣 🍣 🍣Convert from Windows Prefetch to json file.$ prefetch2json /path/to/your/file.pf /path/to/output/target.jsonConvert from Windows Prefetch to Python dict object.fromprefetch2esimportprefetch2jsonif__name__=='__main__':filepath='/path/to/your/file.pf'result:dict=prefetch2json(filepath)Output Format ExampleUsing the sample prefetch file ofEricZimmerman/Prefetchas an example.{
  "name": "CALC.EXE",
  "filenames": [
    "\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\NTDLL.DLL",
    ...
  ],
  "exec_count": 2,
  "last_exec_time": 130974496211967500,
  "format_version": 23,
  "prefetch_hash": 2013131135,
  "metrics": [
    {
      "filename": "\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\NTDLL.DLL",
      "file_reference": 281474976736310
    },
    ...
  ],
  "volumes": [
    {
      "path": "\\DEVICE\\HARDDISKVOLUME2",
      "creation_time": 130974525181093750,
      "serial_number": 2281737263
    }
  ]
}Installationvia PyPI$ pip install prefetch2esvia DockerHub$ docker pull sumeshi/prefetch2es:latestRun with Dockerhttps://hub.docker.com/r/sumeshi/prefetch2esprefetch2es# "host.docker.internal" is only available in mac and windows environments.# For linux, use the --add-host option.$dockerrun-t--rm-v$(pwd):/appsumeshi/prefetch2es:latestprefetch2esSAMPLE.pf--host=host.docker.internalprefetch2json$dockerrun-t--rm-v$(pwd):/appsumeshi/prefetch2es:latestprefetch2esSAMPLE.pfout.jsonDo not use the "latest" image if at all possible.The "latest" image is not a released version, but is built from the contents of the master branch.ContributingCONTRIBUTINGThe source code for prefetch2es is hosted at GitHub, and you may download, fork, and review it from this repository(https://github.com/sumeshi/prefetch2es).
Please report issues and feature requests. :sushi: :sushi: :sushi:Licenseprefetch2es is released under theMITLicense.Powered bylibscca.