Bulk Extractor with Record Carving Hands-on Labs

Choose the browser simulation for coached BEViewer practice, or complete the Full Lab with rec03 and a supplied, verified Windows training image.

Hands-on record-carving proof of concept

Scope it. Carve it. Trace it.

Run one focused record scanner, follow an EVTX result from report to forensic path, and state what the recovered structure can support.

⏱ Setup: 25–35 min · Exercise: 45–65 min◆ Guided beginner✓ Evidence required

Start the Full Lab

Interactive Lab

Full Lab

Isolated Windows VM · Setup: 25–35 min · Exercise: 45–65 min

Bulk Extractor Record Carving Full Lab

rec03, Java BEViewer, verified image and separate output required

Version-bound exercise

This Full Lab targets the supplied 1.6.0-dev-rec03 build. Record every difference if your package exposes different scanner names or output files.

Use authorised training evidence

Work from a verified copy in an isolated VM. Write reports to separate storage, preserve corrupted-record dispositions and never execute output.

Before you begin

You need: an isolated Windows analysis VM, rec03 and its recorded Java runtime, a harmless Windows raw or supported E01 training image, supplied hash information, a compatible EVTX parser and separate controlled report storage.

Case question

Does the image contain a validated carved EVTX structure relevant to the supplied logon investigation, and what source and lifecycle context remain unknown after carving?

Objective

For case SUSA-BE-073, run only the rec03 evtx scanner, review one validated entry in evtx_carved.txt, retain its forensic path and carved object, parse it independently, and write a bounded conclusion without claiming that the record was allocated, complete or produced by a specific user unless corroborated.

01

Activity 1: Establish the scan boundary

1. Record authority, question, image filename, format, byte size and supplied SHA-256.
2. Verify the working-copy hash and stop on a mismatch.
3. Record rec03, BEViewer and Java versions plus executable and launcher paths.
4. Confirm evtx appears in the installed scanner list.
5. Prepare a new empty X:\SUSA-BE-073\bulk-output directory on separate storage.

Milestone 1Scan boundary recordedInput integrity, versions, scanner and empty report destination are reviewable.

Expected result The verified working image is ready and only the EVTX scanner is within scope.

02

Activity 2: Carve and review

1. In BEViewer, select the verified image and new report directory.
2. Select only evtx; preserve the generated command or scanner configuration.
3. Start the scan and record times, progress, completion state, warnings and errors.
4. Expand the report and open evtx_carved.txt.
5. Select one validated row relevant to the supplied question and record forensic path, offset, size and displayed context.
6. Locate the corresponding object in evtx_carved; keep any corrupted output separate.

Milestone 2Carved record remains attributableThe selected result can be traced to its report, feature file, forensic path and input image.

Expected result At least one validated EVTX object and its `evtx_carved.txt` provenance row are preserved.

03

Activity 3: Validate and report

1. Protect and hash the report directory before detailed analysis.
2. Parse the selected EVTX object with a compatible independent parser; record version, command, output and errors.
3. Compare event identifier, provider, computer and timestamps with BEViewer context.
4. Check allocated logs, $MFT, $UsnJrnl or timeline evidence for corroboration when supplied.
5. Separate observed content, interpretation, confidence and carving limitations.

Case and question:
Input image and SHA-256:
rec03, BEViewer and Java versions:
Scanner and complete configuration:
Report directory and hash:
Feature file and forensic path:
Independent parse result:
Conclusion and confidence:
Allocation, completeness and attribution limitations:
Corroboration required:

Milestone 3Finding is reproducibleAnother analyst can repeat the scan and distinguish carved content from unsupported lifecycle claims.

Full Lab evidence checklist

• Core completion

  Required for a reviewable record-carving exercise.

  • Authority, question, image identity, format, size and matching SHA-256.
  • rec03, BEViewer, Java and parser versions and paths.
  • EVTX-only scanner configuration and separate empty output.
  • Start and finish times, completion state, warnings and errors.
  • Feature file, forensic path, offset, size and context.
  • Carved-object and report hashes plus independent parse result.
  • Conclusion, confidence, limitations and corroboration plan.

0 of 7 recorded Mark each item after saving it.Reset

Troubleshooting

Symptom	First check
BEViewer does not open	Verify Java architecture/version, launcher target and rec03 installation path.
EVTX scanner is absent	Confirm that the record-carving rec03 build, rather than upstream 2.x, is installed.
Scan will not start	Confirm readable input, new writable output directory, scanner selection and free space.
Report is incomplete	Review logs, interrupted state, source errors and destination capacity before rerunning separately.
Parser rejects carved output	Separate corrupted candidates, retain parser errors and avoid treating the match as a valid complete EVTX file.

Clean up

Close BEViewer, protect the report and notes, remove disposable working output when authorised, detach training storage and restore the analysis VM snapshot.

PreviousScan and reviewReviewReturn to the overview