Protokol-7/mpenginedb_parser
Standalone Python parser for Microsoft Defender's mpenginedb.db. Decrypts the RC4 page codec, replays the WAL, carves deleted rows and decodes every field to a timeline.
GitHub repository with 8 stars and 1 forks.
Language: Python