WithSecureLabs / chainsaw

Rapidly Search and Hunt through Windows Forensic Artefacts

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

CSV Encoding

evild3ad opened this issue · comments

Awesome tool...thx for sharing with the community!

The CSV output should be in UTF8. Please fix this with your next release. Thank you!

I processed EVTX files from a French system and a lot of characters were bogus. JSON output looked fine.

Cheers!

@evild3ad could you possibly provide a tiny sample file for this? Then I should be able to replicated and fix as I have a feeling it won't be fixed in my PR above.

Sure. How can I send it to your trusted hands? I cannot make the sample public.

Ah right yep, if you are not able to produce a small anonymous example then you could email them to me (a.kornitzer @ me.com) or create a private repo and give me read access, or use some file sharing platform. Happy with any method tbh.

I'll delete them from my machine pretty quickly, as once I identify what the problematic characters are I can replicate with a contrived example.

You got email.

This appears to be an encoding issue in Excel. If you use the import wizard and change the File Origin to UTF-8. Then Excel is happy.

There are no options to change this in the rust csv library and I am not sure we want to start prefixing the file with BOM, etc.

Works! Thank you!

Should work with ImportExcel too. Will test it tomorrow.