### Parsers

Name | Description
--- | ---
amcache | Parser for Amcache Registry entries.
android_app_usage | Parser for Android usage-history.xml files.
apache_access | Apache access Parser
asl_log | Parser for ASL log files.
bash | Parser for Bash history files
bencode | Parser for bencoded files.
binary_cookies | Parser for Safari Binary Cookie files.
bsm_log | Parser for BSM log files.
chrome_cache | Parser for Chrome Cache files.
chrome_preferences | Parser for Chrome Preferences files.
cups_ipp | Parser for CUPS IPP files.
custom_destinations | Parser for *.customDestinations-ms files.
czip | Parser for compound ZIP files.
dockerjson | Parser for JSON Docker files.
dpkg | Parser for Debian dpkg.log files.
esedb | Parser for Extensible Storage Engine (ESE) database files.
filestat | Parser for file system stat information.
firefox_cache | Parser for Firefox Cache version 1 files (Firefox 31 or earlier).
firefox_cache2 | Parser for Firefox Cache version 2 files (Firefox 32 or later).
fsevents | Parser for fseventsd files.
gdrive_synclog | Parser for Google Drive Sync log files.
java_idx | Parser for Java WebStart Cache IDX files.
lnk | Parser for Windows Shortcut (LNK) files.
mac_appfirewall_log | Parser for appfirewall.log files.
mac_keychain | Parser for MacOS Keychain files.
mac_securityd | Parser for MacOS securityd log files.
mactime | Parser for SleuthKit version 3 bodyfiles.
macwifi | Parser for MacOS wifi.log files.
mcafee_protection | Parser for McAfee AV Access Protection log files.
mft | Parser for NTFS $MFT metadata files.
msiecf | Parser for MSIE Cache Files (MSIECF) also known as index.dat.
olecf | Parser for OLE Compound Files (OLECF).
opera_global | Parser for Opera global_history.dat files.
opera_typed_history | Parser for Opera typed_history.xml files.
pe | Parser for Portable Executable (PE) files.
plist | Parser for binary and text plist files.
pls_recall | Parser for PL/SQL Recall files.
popularity_contest | Parser for popularity contest log files.
prefetch | Parser for Windows Prefetch files.
recycle_bin | Parser for Windows $Recycle.Bin $I files.
recycle_bin_info2 | Parser for Windows Recycler INFO2 files.
rplog | Parser for Windows Restore Point (rp.log) files.
santa | Santa Parser
sccm | Parser for SCCM logs files.
selinux | Parser for SELinux audit.log files.
skydrive_log | Parser for OneDrive (or SkyDrive) log files.
skydrive_log_old | Parser for OneDrive (or SkyDrive) old log files.
sophos_av | Parser for Anti-Virus log (SAV.txt) files.
sqlite | Parser for SQLite database files.
symantec_scanlog | Parser for Symantec Anti-Virus log files.
syslog | Syslog Parser
systemd_journal | Parser for Systemd Journal files.
trendmicro_url | Parser for Trend Micro Office Web Reputation log files.
trendmicro_vd | Parser for Trend Micro Office Scan Virus Detection log files.
usnjrnl | Parser for NTFS USN change journal ($UsnJrnl).
utmp | Parser for Linux libc6 utmp files.
utmpx | Parser for Mac OS X 10.5 utmpx files.
winevt | Parser for Windows EventLog (EVT) files.
winevtx | Parser for Windows XML EventLog (EVTX) files.
winfirewall | Parser for Windows Firewall Log files.
winiis | Parser for Microsoft IIS log files.
winjob | Parser for Windows Scheduled Task job (or At-job) files.
winreg | Parser for Windows NT Registry (REGF) files.
xchatlog | Parser for XChat log files.
xchatscrollback | Parser for XChat scrollback log files.
zsh_extended_history | Parser for ZSH extended history files

### Parser plugins: bencode

Name | Description
--- | ---
bencode_transmission | Parser for Transmission bencoded files.
bencode_utorrent | Parser for uTorrent bencoded files.

### Parser plugins: czip

Name | Description
--- | ---
oxml | Parser for OpenXML (OXML) files.

### Parser plugins: esedb

Name | Description
--- | ---
file_history | Parser for File History ESE database files.
msie_webcache | Parser for MSIE WebCache ESE database files.
srum | Parser for System Resource Usage Monitor (SRUM) ESE database files.

### Parser plugins: olecf

Name | Description
--- | ---
olecf_automatic_destinations | Parser for *.automaticDestinations-ms OLECF files.
olecf_default | Parser for a generic OLECF item.
olecf_document_summary | Parser for a DocumentSummaryInformation OLECF stream.
olecf_summary | Parser for a SummaryInformation OLECF stream.

### Parser plugins: plist

Name | Description
--- | ---
airport | Parser for Airport plist files.
apple_id | Parser for Apple account information plist files.
ipod_device | Parser for iPod, iPad and iPhone plist files.
macosx_bluetooth | Parser for Bluetooth plist files.
macosx_install_history | Parser for installation history plist files.
macuser | Parser for MacOS user plist files.
maxos_software_update | Parser for MacOS software update plist files.
plist_default | Parser for plist files.
safari_history | Parser for Safari history plist files.
spotlight | Parser for Spotlight plist files.
spotlight_volume | Parser for Spotlight volume configuration plist files.
time_machine | Parser for TimeMachine plist files.

### Parser plugins: sqlite

Name | Description
--- | ---
android_calls | Parser for Android calls SQLite database files.
android_sms | Parser for Android text messages SQLite database files.
android_webview | Parser for Android WebView databases
android_webviewcache | Parser for Android WebViewCache databases
appusage | Parser for MacOS application usage SQLite database files.
chrome_27_history | Parser for Google Chrome 27 and up history SQLite database files.
chrome_8_history | Parser for Google Chrome 8 - 25 history SQLite database files.
chrome_autofill | Parser for Chrome autofill SQLite database files.
chrome_cookies | Parser for Chrome cookies SQLite database files.
chrome_extension_activity | Parser for Chrome extension activity SQLite database files.
firefox_cookies | Parser for Firefox cookies SQLite database files.
firefox_downloads | Parser for Firefox downloads SQLite database files.
firefox_history | Parser for Firefox history SQLite database files.
google_drive | Parser for Google Drive SQLite database files.
hangouts_messages | Parser for Google Hangouts Messages SQLite database files.
imessage | Parser for the iMessage and SMS SQLite databases on OSX and iOS.
kik_messenger | Parser for iOS Kik messenger SQLite database files.
kodi | Parser for Kodi MyVideos.db files.
ls_quarantine | Parser for LS quarantine events SQLite database files.
mac_document_versions | Parser for document revisions SQLite database files.
mac_knowledgec | Parser for Duet / KnowledgeC database file.
mac_notes | Parser for Mac Notes
mac_notificationcenter | Parser for the Notification Center SQLite database
mackeeper_cache | Parser for MacKeeper Cache SQLite database files.
safari_history | Parser for Safari history SQLite database files.
skype | Parser for Skype SQLite database files.
tango_android_profile | Parser for Tango on Android profile database.
tango_android_tc | Parser for Tango on Android tc database.
twitter_android | Parser for Twitter on android database
twitter_ios | Parser for Twitter on iOS 8+ database
windows_timeline | Parser for the Windows Timeline SQLite database
zeitgeist | Parser for Zeitgeist activity SQLite database files.

### Parser plugins: syslog

Name | Description
--- | ---
cron | Parser for syslog cron messages.
ssh | Parser for SSH syslog entries.

### Parser plugins: winreg

Name | Description
--- | ---
appcompatcache | Parser for Application Compatibility Cache Registry data.
bagmru | Parser for BagMRU Registry data.
ccleaner | Parser for CCleaner Registry data.
explorer_mountpoints2 | Parser for mount points Registry data.
explorer_programscache | Parser for Explorer ProgramsCache Registry data.
microsoft_office_mru | Parser for Microsoft Office MRU Registry data.
microsoft_outlook_mru | Parser for Microsoft Outlook search MRU Registry data.
mrulist_shell_item_list | Parser for Most Recently Used (MRU) Registry data.
mrulist_string | Parser for Most Recently Used (MRU) Registry data.
mrulistex_shell_item_list | Parser for Most Recently Used (MRU) Registry data.
mrulistex_string | Parser for Most Recently Used (MRU) Registry data.
mrulistex_string_and_shell_item | Parser for Most Recently Used (MRU) Registry data.
mrulistex_string_and_shell_item_list | Parser for Most Recently Used (MRU) Registry data.
msie_zone | Parser for Internet Explorer zone settings Registry data.
mstsc_rdp | Parser for Terminal Server Client Connection Registry data.
mstsc_rdp_mru | Parser for Terminal Server Client MRU Registry data.
network_drives | Parser for Network Registry data.
networks | Parser for NetworkList data.
userassist | Parser for User Assist Registry data.
windows_boot_execute | Parser for Boot Execution Registry data.
windows_boot_verify | Parser for Boot Verification Registry data.
windows_run | Parser for run and run once Registry data.
windows_sam_users | Parser for SAM Users and Names Registry keys.
windows_services | Parser for services and drivers Registry data.
windows_shutdown | Parser for ShutdownTime Registry value.
windows_task_cache | Parser for Task Scheduler cache Registry data.
windows_timezone | Parser for Windows timezone settings.
windows_typed_urls | Parser for Explorer typed URLs Registry data.
windows_usb_devices | Parser for USB device Registry entries.
windows_usbstor_devices | Parser for USB Plug And Play Manager USBStor Registry Key.
windows_version | Parser for Windows version Registry data.
winlogon | Parser for winlogon Registry data.
winrar_mru | Parser for WinRAR History Registry data.
winreg_default | Parser for Registry data.

### Parser presets (data/presets.yaml)

Name | Parsers and plugins
--- | ---
android | android_app_usage, chrome_cache, filestat, sqlite/android_calls, sqlite/android_sms, sqlite/android_webview, sqlite/android_webviewcache, sqlite/chrome_27_history, sqlite/chrome_8_history, sqlite/chrome_cookies, sqlite/skype
linux | bash_history, bencode, czip/oxml, dockerjson, dpkg, filestat, gdrive_synclog, java_idx, olecf, pls_recall, popularity_contest, selinux, sqlite/google_drive, sqlite/skype, sqlite/zeitgeist, syslog, systemd_journal, utmp, webhist, xchatlog, xchatscrollback, zsh_extended_history
macos | asl_log, bash_history, bencode, bsm_log, cups_ipp, czip/oxml, filestat, fseventsd, gdrive_synclog, java_idx, mac_appfirewall_log, mac_keychain, mac_securityd, macwifi, olecf, plist, sqlite/appusage, sqlite/google_drive, sqlite/imessage, sqlite/ls_quarantine, sqlite/mac_document_versions, sqlite/mac_notes, sqlite/mackeeper_cache, sqlite/mac_knowledgec, sqlite/skype, syslog, utmpx, webhist, zsh_extended_history
webhist | binary_cookies, chrome_cache, chrome_preferences, esedb/msie_webcache, firefox_cache, java_idx, msiecf, opera_global, opera_typed_history, plist/safari_history, sqlite/chrome_27_history, sqlite/chrome_8_history, sqlite/chrome_autofill, sqlite/chrome_cookies, sqlite/chrome_extension_activity, sqlite/firefox_cookies, sqlite/firefox_downloads, sqlite/firefox_history
win7 | amcache, custom_destinations, esedb/file_history, olecf/olecf_automatic_destinations, recycle_bin, winevtx, win_gen
win7_slow | mft, win7
win_gen | bencode, czip/oxml, esedb, filestat, gdrive_synclog, java_idx, lnk, mcafee_protection, olecf, pe, prefetch, sccm, skydrive_log, skydrive_log_old, sqlite/google_drive, sqlite/skype, symantec_scanlog, usnjrnl, webhist, winfirewall, winjob, winreg
winxp | recycle_bin_info2, rplog, win_gen, winevt
winxp_slow | mft, winxp

