Bulk Extractor with Record Carving Hands on Labs

Practise tracing a carved result in your browser, or recover and check a real training event with rec03 on a disposable Windows VM.

Interactive Lab

Browser practice

Bulk Extractor Record Carving Interactive Lab

Expand labOpen in new tab

No installation

Aster's support team found a gap in a workstation's saved logs. Check the image copy for a PowerShell record around 10:16 UTC. Find the matching record, save its byte offset and leave a short note for the next analyst.

Browser exercise · This window copies the older Java BEViewer used with rec03. The scan and report are simulated. The downloads contain example XML and sample bytes. They are not real EVTX files and will not work with an EVTX parser.

1. 1Scan
2. 2Inspect
3. 3Check events
4. 4Hand over

Show hint

SUSA-BE-073 · WS-07Find: PowerShell activity near 10:16 UTC

Full Lab

Self hosted / real record carving

Bulk Extractor Record Carving Full Lab

Windows VM + rec03

Case SUSA-BE-073 / a gap in the logs

Recover a log entry. Check it. Explain what it shows.

The Aster support team reports a gap in a workstation's logs. Practise the recovery workflow with one harmless event on your Windows VM: save a small byte sample, carve its event log with rec03, and check the recovered entry outside BEViewer.

Tick a box after saving its evidence. This page saves your ticks, but cannot check your VM or the carved results.

Investigation brief

Case questionCan you recover the support marker from the sample and show where it came from?

Your task

One sample, one scanner, one checked event and a short handover. Allow about 30 to 45 minutes after installing the tool.

Real case link: Analysts carve event log data when normal logs are missing or incomplete. Here you use an intact exported log inside a small byte sample, so you have a known answer to compare. Finding it does not demonstrate recovery of deleted data.

Before you start

Need: a disposable Windows 10 or 11 VM, administrator access, Windows PowerShell 5.1, the 1.6.0-dev-rec03 build and its Java BEViewer. Take a clean snapshot. The commands below create the training input; no disk image download is needed.

Run: open Windows PowerShell as administrator inside the VM. Copy the blocks in order and check each Look for result. All paths start at C:\Cases\SUSA-BE-073; use another new case folder if it already exists.

Need setup help?

Follow Install and open and confirm BEViewer starts. Use the rec03 build for this lab; scanner names and the viewer differ between versions. Record the scanner executable, viewer launcher and Java version in your case notes. Windows supplies eventcreate to write the marker and wevtutil to export it.

How does this compare with the Interactive Lab?

The browser lab uses example PowerShell XML. This Full Lab creates a real Application log event with ID 73 and a harmless support message. It teaches the same scan, source location, check and handover steps. Use your VM's actual event time and computer name; the browser's offsets and 10:16 UTC time do not apply here.

Activity 1: Prepare the sample

Your first winCreate a small, real event log sample and save its starting hash.

1. Create your case folder

Keep this PowerShell window open. This block stops if the folder already exists so an earlier run stays intact.

$beCase = 'C:\Cases\SUSA-BE-073'
if (Test-Path -LiteralPath $beCase) { throw 'Case folder exists. Choose a new folder.' }
New-Item -ItemType Directory -Path "$beCase\input", "$beCase\notes" -ErrorAction Stop | Out-Null
@(
    "Computer: $env:COMPUTERNAME"
    "Local time: $(Get-Date -Format o)"
    "Time zone: $((Get-TimeZone).Id)"
    'Question: Can rec03 recover the support marker from the sample?'
    'Scope: harmless training data on this disposable VM'
) | Set-Content -LiteralPath "$beCase\notes\case-context.txt"

Look for: input and notes folders. Open case-context.txt and add the rec03, BEViewer and Java versions and their paths.

2. Write one harmless event and export it

This adds a labelled entry to the VM's Application log. It does not run the activity described in the message. Save the event's XML as your reference, then export that event to an EVTX file (Windows' event log format).

eventcreate /T INFORMATION /ID 73 /L APPLICATION /SO SUSA-BE-073 /D "SUSA-BE-073 training marker: support checked this workstation."
if ($LASTEXITCODE -ne 0) { throw 'Event creation failed. Check administrator access.' }
$beMarker = Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='SUSA-BE-073'; Id=73} -MaxEvents 1 -ErrorAction Stop
$beMarker.ToXml() | Set-Content -LiteralPath "$beCase\notes\reference-event.xml" -Encoding UTF8
$beQuery = "*[System[(EventRecordID=$($beMarker.RecordId))]]"
wevtutil epl Application "$beCase\input\support-marker.evtx" "/q:$beQuery" /ow:false
if ($LASTEXITCODE -ne 0) { throw 'Export failed. Keep the error and inspect the case folder.' }
Get-WinEvent -Path "$beCase\input\support-marker.evtx" -Oldest -ErrorAction Stop |
    Format-List Id, ProviderName, MachineName, TimeCreated, RecordId, Message

Look for: event ID 73, provider SUSA-BE-073, your VM name and the support message. Save the actual event time. If the event is missing, fix the export before continuing.

3. Make the scan input and record its hash

Place the exported log after 4,096 empty bytes. This gives you a known source offset to trace in BEViewer. training.raw is a raw byte sample, not a disk or file system image. Keep the exported EVTX as the original for comparison.

$beLogBytes = [IO.File]::ReadAllBytes("$beCase\input\support-marker.evtx")
$beSample = New-Object byte[] (4096 + $beLogBytes.Length)
[Array]::Copy($beLogBytes, 0, $beSample, 4096, $beLogBytes.Length)
[IO.File]::WriteAllBytes("$beCase\input\training.raw", $beSample)
Get-FileHash -Algorithm SHA256 -LiteralPath "$beCase\input\support-marker.evtx", "$beCase\input\training.raw" |
    Export-Csv -LiteralPath "$beCase\notes\input-sha256.csv" -NoTypeInformation
Get-Item -LiteralPath "$beCase\input\training.raw" | Select-Object Name, Length

Look for: a nonempty training.raw and two rows in input-sha256.csv. SHA-256 is a file fingerprint: use it later to check whether a file changed. The two input files have different bytes, so their hashes should differ.

Ready to carve I saved the VM details, tool versions and reference event XML. I created the byte sample and saved both input hashes.Pause point: keep the case folder. In a new window, set $beCase = 'C:\Cases\SUSA-BE-073' again using your actual path.

Next: scan the sample with evtx only.

Continue to carving ›

Activity 2: Carve and review

Your next winFind a carved log and link it to a row in the scan report.

Make your call

You placed the exported log at byte 4,096. Predict the first carved file's source offset. Would finding it prove that a log was deleted?

1. Set up an EVTX only scan

Open BEViewer and click the gear button (Run bulk_extractor). Set Image File to C:\Cases\SUSA-BE-073\input\training.raw and Output Feature Directory to C:\Cases\SUSA-BE-073\bulk-output. Change these paths if you chose another case folder.

Use a new output path and let the scanner create it. Clear the scanner selections, then select evtx only. Leave tuning options at their defaults. Save the generated command in notes\scan-command.txt.

Look for: only evtx selected, and an output path outside input. If evtx is missing, check the rec03 installation. For this small training sample, separate input and output folders on the VM are enough. With a real evidence image, use the separate controlled output storage described in Scan and review.

Prefer the command line?

Use the installed executable's actual path. This is the same single scanner run; choose either the GUI or this command, not both into the same output folder.

& 'C:\Program Files\Bulk Extractor 1.6.0-dev-rec03\bulk_extractor.exe' -E evtx -o "$beCase\bulk-output" "$beCase\input\training.raw"

Save the exact command, console output and exit code in your notes. Open the completed output folder in BEViewer. If your installation path differs, use the path you recorded in Activity 1.

2. Run the scan and check it finished

Start the scan. Record the start and finish times and copy warnings or errors into notes\scan-notes.txt. Keep report.xml and all output files together.

Look for: successful completion, report.xml, evtx_carved.txt and an evtx_carved folder with at least one .evtx file. A finished progress bar alone is not enough: check the output and messages. If the run fails, keep it and use a new output name for a retry.

3. Trace one result to its source

In Reports, expand bulk-output and select evtx_carved.txt. Select the row for a file whose name includes valid_header. Read its Forensic Path (the location in the scanned input), size and generated filename. Compare the Text and Hex views of the nearby bytes.

Look for: a file header result at offset 4096 for the sample you created. In Hex, the EVTX header starts 45 6c 66 46 69 6c 65 00 (ElfFile). The remaining filename and chunk count depend on your export. Save the whole feature row and the corresponding carved file path in notes\selected-feature.txt.

BEViewer shows source bytes and locations; use the next activity to read the events. A generated output name is not the original log path. Extra results do not necessarily represent different events. Keep fragments or files marked as corrupt, but do not count them as readable events without a parser check.

No rows, or a different offset?

Check that you scanned training.raw, not the exported EVTX, and that only evtx was enabled. Open evtx_carved.txt as text to distinguish comment lines from result rows. Confirm the export was readable in Activity 1. Keep any unexpected result and record what differs; do not invent a matching row.

Result saved I kept the scan settings, times, messages and complete output folder. I saved a feature row and its carved file path, or explained why no usable result was found.Pause point: keep the whole report. A scanner match still needs an independent event check.

Next: read the carved event outside BEViewer.

Check and hand over ›

Activity 3: Check and hand over

Your final winCompare the recovered marker with the reference and leave a finding another analyst can check.

1. Read the carved file with Windows' event parser

Set $beCarved to the actual full path you saved in Activity 2. Copy it from Explorer; do not use the placeholder below. This check uses Windows' Get-WinEvent reader independently of rec03 and BEViewer.

$beCarved = 'PASTE THE FULL PATH TO YOUR SELECTED CARVED .evtx FILE HERE'
if (-not (Test-Path -LiteralPath $beCarved -PathType Leaf)) { throw 'Set the actual carved file path first.' }
try {
    $beRecovered = @(Get-WinEvent -Path $beCarved -Oldest -ErrorAction Stop |
        Where-Object { $_.Id -eq 73 -and $_.ProviderName -eq 'SUSA-BE-073' })
    if ($beRecovered.Count -eq 0) { throw 'No matching training marker was read.' }
    $beRecovered | Format-List Id, ProviderName, MachineName, TimeCreated, RecordId, Message |
        Out-String | Set-Content -LiteralPath "$beCase\notes\recovered-marker.txt"
    $beRecovered[0].ToXml() | Set-Content -LiteralPath "$beCase\notes\recovered-event.xml" -Encoding UTF8
    Get-Content -LiteralPath "$beCase\notes\recovered-marker.txt"
} catch {
    $_ | Out-String | Set-Content -LiteralPath "$beCase\notes\parser-error.txt"
    throw
}

Look for: ID 73, provider SUSA-BE-073, your VM name and the support message. Compare recovered-event.xml with reference-event.xml: check the provider, event ID, computer, record ID, UTC SystemTime and event data. A matching marker is the result you wanted. A filename containing valid_header alone does not validate every event in the file.

The parser fails or the message is blank

Keep parser-error.txt and the selected file. Check that you chose a .evtx file, not an orphan fragment or the feature text file. You can try a compatible EvtxECmd build using -f with the file path and --csv with a new parser output folder; save its version, command and errors. Missing message text can also reflect missing provider resources, so compare the stored XML event data. If neither parser can read the event, report an unverified candidate and the error. Do not tick a successful recovery into your handover.

2. Check file integrity and write your finding

Recheck the input hashes and save hashes of each output file. A directory has no single file SHA-256. Keep the output hash list in notes, outside the folder it describes.

foreach ($beSaved in (Import-Csv -LiteralPath "$beCase\notes\input-sha256.csv")) {
    $beNow = (Get-FileHash -Algorithm SHA256 -LiteralPath $beSaved.Path).Hash
    if ($beNow -ne $beSaved.Hash) { throw 'Input hash changed. Stop and investigate.' }
}
Get-ChildItem -LiteralPath "$beCase\bulk-output" -Recurse -File |
    Get-FileHash -Algorithm SHA256 |
    Export-Csv -LiteralPath "$beCase\notes\output-sha256.csv" -NoTypeInformation
'Input hashes still match. Output file hashes saved.'

Make the analyst's callThe parser reads the marker and its fields match the reference. What can you say?

Someone deleted this log to hide activity.The sample contains a readable support marker at the recorded source location.The message proves support checked the workstation.

Choose a finding, then use your actual results in the handover.

Save this as notes\handover.txt. A clear failure finding also counts as a completed investigation if it includes the saved errors and a next step.

Question: Can the support marker be recovered from this sample?
VM name, time zone and tool versions:
Input file, size and SHA-256:
Scanner command, run times, warnings or errors:
Report folder, feature row, source offset and carved file:
Parser used, result and any errors:
Reference comparison: ID, provider, computer, UTC time, record ID and data.
Finding: What did I actually recover and check?
Limits: This sample does not establish deletion, original log path or user intent.
Next check: Which other evidence would test the reported support activity?

Example finding: “rec03 recovered an EVTX file from byte 4096 of my training sample. Windows read the ID 73 support marker, and its stored fields matched my reference. This confirms the marker is present in the sample. I would check a support ticket and other workstation logs before accepting the activity described in its message.” Replace this with your actual result if the check failed or differed.

Case closeout3. Preserve the case and restore the VM

Open the saved handover, feature note and hash lists. Check that the exported log, sample and complete scan output are still present. Copy the whole case folder outside the VM and open that copy before restoring your snapshot.

Close BEViewer and restore the disposable VM snapshot to remove the training event and source registration. Do not clear the Application log just to remove this one marker.

Optional: apply the workflow to a training disk image

Use an authorised Windows raw image or an E01 supported by your rec03 build, with a supplied hash and case question. Verify the working copy and scan it into a new output folder. Choose one event log result, keep its full forensic path and parse it independently. The result may contain a rebuilt header, an intact log or an unreadable fragment; the core sample does not test all these cases.

Compare the finding with any supplied allocated logs, $MFT, $UsnJrnl or timeline. These can help check the original file and surrounding activity. A carved row alone cannot tell you whether a record was deleted, who caused a gap, or whether a reported action succeeded. No matching event means “not found in this run,” not “never happened.”

Ready for another analyst I saved the parser result or errors, hash checks and a finding with limits and a next check. I checked a copy of the complete case folder outside the VM before restoring it.Your saved files support completion; the browser ticks are reminders.

Finish with a note someone else can check from the saved files.

Review the evidence checklist ›

Full Lab evidence checklist

Case folder handoverSave the two checkpoints in each activity.

• 1Starting evidenceinput/ with the EVTX export and sample; case context, reference XML and input hashes in notes/.
• 2Carving runComplete bulk-output/, the scan command and messages, and the selected feature row and carved file path.
• 3Checked findingRecovered event XML and marker details, or parser errors; output hashes and handover.txt.

Case complete: you can trace your finding from the saved note to the parser result, carved file, feature row and input sample. Keep failed runs and explain any gaps.

PreviousScan and reviewReviewReturn to the overview