WithSecureLabs / chainsaw

Rapidly Search and Hunt through Windows Forensic Artefacts

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Memory Exhaustion Error

fscc-jamesd opened this issue · comments

When running chainsaw in search mode against a very large set of event logs, if the search parameters are broad enough to capture a lot of results then the memory used by Chainsaw will balloon and may result in the binary being terminated.

This is due to #7 where we now load hits into a Vec before printing in order to output JSON correctly. If there are too many matches then the Vec will bloat out and consume too much memory.

This has been done in #23. A new build will be pushed out in the next couple of days.