Install and prepare DHParser

Prepare a reproducible examination

Before the first command

Keep the protected source, verified working copy, parser, and generated JSON in separate locations. This makes the examination repeatable and prevents parser output from being mistaken for acquired evidence.

Obtain and identify the parser

Download DHParser only from the official project repository. The preserved screenshot shows the original GitHub download workflow.

Preserved source screenshot: select dhparser.exe from the official repository release content.

Record the source URL, retrieval time, displayed version, filename, size, and a SHA-256 hash. Do not assume an unsigned or standalone executable is trustworthy because its filename looks correct.

certutil -hashfile "C:\Tools\DHParser\dhparser.exe" SHA256

Case note

If your organisation packages the parser internally, record both the internal package reference and the hash of the executable actually used.

Use a safe training source

The original demonstration created a Defender record by downloading a credential-dumping tool. The screenshot is retained for historical continuity, but that activity is not part of this guide or its labs.

Historical screenshot only. Use supplied evidence or an approved benign test artefact in an isolated training VM.

For learning, use an instructor-provided DetectionHistory record, a synthetic fixture, or an approved benign security test such as EICAR in a disposable and authorised VM. Never create evidence by introducing real credential theft or malware tooling.

Establish the evidence boundary

SourceE:\Cases\SUSA-126\source\

Read-only acquisition and its manifest. Do not parse here.

WorkingE:\Cases\SUSA-126\working\

Verified copy that retains the numbered folder and GUID filename.

OutputE:\Cases\SUSA-126\output\

Empty destination for parser-created JSON and logs.

NotesE:\Cases\SUSA-126\notes\

Commands, hashes, times, messages, and interpretation.

On a live Windows system, records commonly reside below:

C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\DetectionHistory

This tree is protected and may change while Defender is active. Follow your authority and acquisition procedure, preserve the full source path, and parse a verified working copy. Retain the numbered parent directory as well as the GUID record name.

Verify the working copy

Hash the source record and its working copy with an approved tool. The values must match before parsing.

certutil -hashfile "E:\Cases\SUSA-126\source\22\A3F2D9B1-42A7-4D8E-90F1-2C5B7A6E1104" SHA256
certutil -hashfile "E:\Cases\SUSA-126\working\22\A3F2D9B1-42A7-4D8E-90F1-2C5B7A6E1104" SHA256

Boundary checkWhich location should DHParser read?

The hash-matched working copyThe live protected Defender directoryThe parser output directory

Choose the input that protects the source and remains reproducible.

Preparation checklist

• ScopeAuthority and case identifier recorded
• ToolOrigin, version, size, and SHA-256 recorded
• SourceOriginal DetectionHistory path and acquisition method recorded
• ContextNumbered folder and GUID filename retained
• IntegritySource and working-copy SHA-256 values match
• OutputEmpty destination created outside the evidence tree
• NotesSystem time context and analyst notes location recorded

PreviousDHParser overviewNextParse and review