GitHub repository: williballenthin/EVTXtract
Primary language: Python
Description: EVTXtract recovers and reconstructs fragments of EVTX log files from raw binary data, including unallocated space and memory images.