Command List¶

Individual parsers are grouped by their source type. Run juntei --help, juntei <SOURCE> --help, or juntei <SOURCE> <ARTIFACT> --help to explore them:

juntei parse-ntfs --help
juntei parse-registry amcache --help
juntei parse-file prefetch -d evidence/ -o prefetch.csv

For a multi-computer Windows evidence collection, use juntei auto-parse -d <EVIDENCE> -o <OUTPUT>. It invokes the same grouped commands and organizes results and logs by computer and investigative category.

For a timeline across parsed artifacts, use juntei super-timeline -d <PARSED> -o SuperTimeline.csv. It expands and labels timestamp meanings. Output is unsorted by default; add --sort for chronological order and duplicate consolidation. auto-parse -j continues to retain native records.

Disk images ¶

Command	Input	Detailed guide
`mount`	VHDX / E01 / Ex01 disk image	Mounting Disk Images

ESE commands ¶

Command	Input artifact	Detailed guide
`parse-ese srum`	ESE `SRUDB.dat`	SRUM
`parse-ese ual`	ESE `Current.mdb`, `{GUID}.mdb`, `SystemIdentity.mdb`	User Access Logging (UAL)
`parse-ese webcache`	ESE `WebCacheV01.dat`	Internet Explorer and Legacy Edge

File commands ¶

Command	Input artifact	Detailed guide
`parse-file defender-quarantine`	Defender quarantine tree or entry	Defender Quarantine
`parse-file jump-lists`	`.automaticDestinations-ms`, `.customDestinations-ms`	Jump Lists
`parse-file lnk`	`*.lnk`	LNK Shortcuts
`parse-file outlook`	`.pst`, `.ost`, `.msg`, `.oft`	Outlook
`parse-file prefetch`	`*.pf`	Prefetch

NTFS commands ¶

Command	Input artifact	Detailed guide
`parse-ntfs boot`	`$Boot`, or an NTFS volume image	Boot Sector ($Boot)
`parse-ntfs i30`	`$I30` (`$INDEX_ALLOCATION`), or a disk image	Directory Indexes ($I30)
`parse-ntfs logfile`	NTFS `$LogFile`	NTFS Transaction Log
`parse-ntfs mft`	NTFS `$MFT`	Master File Table
`parse-ntfs secure-sds`	`$Secure:$SDS` (`$Secure_$SDS`)	Security Descriptors ($Secure:$SDS)
`parse-ntfs usn-journal`	`$UsnJrnl:$J`	USN Journal

Registry commands ¶

Command	Input artifact	Detailed guide
`parse-registry amcache`	`Amcache.hve`	Amcache
`parse-registry networks`	`SOFTWARE`, `SYSTEM`	Networks
`parse-registry lsa-secrets`	`SECURITY`	LSA Secrets
`parse-registry bcd`	`BCD` (and `BCD-Template`)	Boot Configuration Data (BCD)
`parse-registry app-compat`	`SOFTWARE`, `NTUSER.DAT`	Application Compatibility
`parse-registry auditpol`	`SECURITY`	Audit Policy
`parse-registry office`	`NTUSER.DAT`	Microsoft Office
`parse-registry feature-usage`	`NTUSER.DAT`	FeatureUsage, RecentApps and Taskbar Pins
`parse-registry app-history`	`NTUSER.DAT`	Application History
`parse-registry mru`	`NTUSER.DAT`	Most-Recently-Used Lists
`parse-registry bam`	`SYSTEM` (with `SAM`, `SOFTWARE` for user names)	BAM and DAM
`parse-registry muicache`	`UsrClass.dat` (`NTUSER.DAT` on Windows XP)	MuiCache
`parse-registry installed-programs`	`SOFTWARE`, `NTUSER.DAT`	Installed Programs
`parse-registry open-save-mru`	`NTUSER.DAT`	Open and Save As Dialogs
`parse-registry persistence`	`SOFTWARE`, `SYSTEM`, `NTUSER.DAT`, `UsrClass.dat`	Registry Autostarts
`parse-registry read`	Any primary registry hive	Registry Hives
`parse-registry recent-docs`	`NTUSER.DAT`	RecentDocs
`parse-registry remote-access`	`NTUSER.DAT` (with `SOFTWARE` for user SIDs)	Remote Access (User Side)
`parse-registry sam`	`SAM`	SAM Local Accounts
`parse-registry security-settings`	`SOFTWARE`, `SYSTEM`, `NTUSER.DAT`	Security Settings
`parse-registry services`	`SYSTEM`	Windows Services
`parse-registry shimcache`	`SYSTEM` or an exported AppCompatCache value	ShimCache
`parse-registry system-info`	`SYSTEM`, `SOFTWARE`, `SAM`, `SECURITY` of one system	System Information
`parse-registry taskcache`	`SOFTWARE`	Task Scheduler Cache
`parse-registry usb`	`SYSTEM`, with `SOFTWARE` and `NTUSER.DAT`	USB Devices
`parse-registry user-assist`	`NTUSER.DAT`	UserAssist
`parse-registry shell-bags`	`UsrClass.dat`, `NTUSER.DAT`	ShellBags

SQLite commands ¶

Command	Input artifact	Detailed guide
`parse-sqlite browser`	`History`, `Cookies`, `Web Data`, `places.sqlite`, `cookies.sqlite`, `formhistory.sqlite`	Web Browsers

Source types and format changes¶

Groups describe the formats Juntei currently supports. parse-registry amcache reads Amcache.hve; it does not imply support for SQLite Amcache inventory databases. Artifact parser crates remain separate so support for another storage format can be added independently.

The former flat parser names have been replaced by the source-and-artifact paths above. Keep existing parser options after the artifact name. auto-parse and existing registry subcommands keep their names.

Persistence Hunter ¶

juntei persistence-hunter hunts across several source formats, so it is a top-level analysis command. It complements the full configuration inventory from parse-registry persistence with 131 checks, allow/block classification, payload metadata, coverage, and timestamp correlation.

Top-level usage¶

Usage: juntei <COMMAND>

Commands:
  auto-parse          Discover and parse Windows evidence
  help                Print this message or the help of the given subcommand(s)
  mount               Mount a VHDX or E01 disk image read-only (FUSE)
  parse-ese           Parse ESE databases
  parse-file          Parse file artifacts
  parse-ntfs          Parse NTFS artifacts
  parse-registry      Parse registry hives
  parse-sqlite        Parse SQLite databases
  persistence-hunter  Hunt offline Windows persistence

Options:
  -h, --help     Print help
  -V, --version  Print version

The source pages reproduce command usage and give short examples. The artifact guides explain the evidence, output fields, limitations, and investigation strategy.

Command List¶

Disk images¶

ESE commands¶

File commands¶

NTFS commands¶

Registry commands¶

SQLite commands¶