ITADN

Add Lenient Parsing Mode to Handle Corrupted EVTX Files

#128ClosedTzion0 创建于 2026-03-26
enhancement
T
Tzion0commented
## Summary Introduce a "lenient" or "tolerant" parsing mode for EVTX files to allow processing of partially corrupted, malformed, or incomplete event log data instead of failing on chunk header parsing errors. Currently, parsing stops when encountering errors such as `"Failed to parse chunk header"`, which prevents extraction of usable data from otherwise partially valid EVTX files. The strict parsing behavior is inherited from the underlying parser (PyEvtxParser), which enforces rigid validation and halts on malformed structures. ## Use case This would be highly useful in forensic and incident response scenarios where EVTX files are often: - Corrupted due to disk damage or improper acquisition - Partially overwritten or truncated - Tampered with by attackers attempting log evasion In such cases, investigators still need to recover as many valid records as possible rather than losing the entire file due to strict parsing failures. This feature would enable: - Partial data recovery from damaged EVTX files - Improved resilience in automated pipelines (e.g., large-scale log ingestion) - Better compatibility with real-world forensic artifacts ## Possible implementation - Add a CLI flag such as: - `--lenient` or `--tolerant` - `--skip-bad-chunks` - Modify parsing behavior to: - Catch exceptions raised by PyEvtxParser when encountering corrupted chunk headers - Skip problematic chunks and continue parsing subsequent ones - Log warnings instead of terminating execution - Provide configurable verbosity levels: - Silent skip - Warning logs - Debug-level detailed error reporting - Optionally implement a wrapper around PyEvtxParser to override strict failure behavior and allow best-effort parsing - (Advanced) Introduce fallback heuristics to recover partially readable event records from damaged chunks
关闭于 2026-03-28 1 条评论