A Dissect module implementing a parser for Event Trace Log (ETL) files, used by the Windows operating system to log kernel events.
dissect.etl is available on PyPI.
$ pip install dissect.etl
This module is also automatically installed if you install the
This package is a library with no CLI tools, so you can only interact with it from Python. For example, to print all records in an ETL file:
from dissect.etl import ETL with open("/path/to/file.etl", "rb") as fh: etl = ETL(fh) for record in etl: print(etl)
For more details, please refer to the API documentation of