Automatic Collection Parsing

auto-parse is the quickest way to turn a multi-computer Windows triage collection into a structured analysis directory. Give it the evidence root and a new output directory. It discovers the collected systems, identifies their computer names, and runs every compatible Juntei parser in parallel.

juntei auto-parse -d <EVIDENCE> -o <OUTPUT>

The default output is CSV. Add a JSONL timeline for jq or SIEM import while keeping those CSV results:

juntei auto-parse -d <EVIDENCE> -o <OUTPUT> -j <OUTPUT>/timeline.jsonl

Keep the output and evidence trees separate

Juntei refuses an output directory that is inside <EVIDENCE> or contains <EVIDENCE>. This prevents generated data from being rediscovered as evidence and prevents --clobber from touching files in the source collection.

VHDX disk images

With --vhdx, auto-parse reads VHDX images natively on Linux, macOS and Windows, using ys-vhdx-parser. No OS mount, FUSE driver, or administrator privileges are needed.

# A directory of images, searched recursively
juntei auto-parse -d /cases/vhdx --vhdx -o parsed
# One image
juntei auto-parse -d host1.vhdx --vhdx -o parsed -j timeline.jsonl

The artifact parsers need filesystem paths. Juntei therefore copies the files they read from the reader's NTFS volumes into a private staging workspace, then runs the usual parsers: registry hives and their transaction logs, NTFS metadata files, databases, prefetch files, shortcuts, jump lists, Outlook files and Defender quarantine folders. Every other file is an empty placeholder with its original modification time, so directories and paths look as they do on the disk. persistence-hunter reads a placeholder's content from the image only when it needs it, such as an executable that a persistence entry refers to. Allow enough temporary disk space for the copied files, in addition to the results. Reads use bounded buffers; zero-filled regions are written as holes where the host filesystem supports them. Original filenames, directory structure, hard links, and file modification times are preserved. LNK and Jump List source creation/modification/access times come from a snapshot of the original NTFS metadata, never the temporary files. The workspace is removed on normal completion, including reported parser errors; a forced termination can leave temporary files. The source image is opened read-only, and pending VHDX log updates are applied in memory only.

Computer discovery, per-host output, CSV/JSON/JSONL, and -j use the same parsing pipeline as ordinary evidence directories. Image in manifest.json identifies the original image and EvidenceRoot identifies the relative path inside the prepared image tree. Unreadable images, volumes, files, and filenames that cannot be represented safely are reported in ImageErrors and failed rows of manifest.csv. Readable evidence is still parsed, and the process exits with status 1 if any image input was incomplete. Unsafe or ambiguous names are rejected rather than silently renamed. Named NTFS streams are not synthesized as extra files; already-collected artifacts stored as ordinary files inside a triage image remain available.

The separate mount command exposes a filesystem to other programs and still needs Linux FUSE. It is not used by auto-parse --vhdx.

Staging uses a private directory on the output filesystem by default. Use --temp-dir to choose an existing staging directory on another disk. Original source metadata is kept separately on the output filesystem, so a full staging disk does not prevent parsing already-readable files. Reserve space for both staged files and results; if the output filesystem itself is full, results cannot be saved. Ctrl+C stops parser processes, cleans the private workspace and exits with code 130. A forced termination such as SIGKILL or power loss can still leave copies. Inaccessible subdirectories are skipped during image discovery; an unreadable input root remains an error.

The staging directory must be outside the output directory. On Linux and macOS, SIGTERM and SIGHUP also stop parser processes and clean up the workspace.

juntei auto-parse --vhdx -d evidence.vhdx -o parsed --temp-dir /large-disk/work

E01 and Ex01 disk images

--e01 reads physical EWF1 (.E01) and EWF2 (.Ex01) images natively on Linux, macOS and Windows, without FUSE, an OS mount, or administrator privileges. It uses ys-e01-parser and the same NTFS parsing pipeline described above.

Provide the first segment of a split image. Keep all companions, including .E02, beside it with their original names. Both whole disks (MBR/GPT) and single NTFS volumes are supported. Use --vhdx --e01 for a directory containing both formats.

The same temporary-space and source-metadata requirements apply. E01 images usually hold whole disks, and every image is staged before parsing starts, but only the files the parsers read are copied: usually a small part of the used space. Images are read-only. Acquisition gaps and damage found during opening or reading appear in ImageErrors and manifest.csv; readable results are retained with exit status 1. This checks accessed data, not every chunk or the image's full-media hash. Logical .L01 and .Lx01 files are rejected; there is no password option.

The separate mount command still requires Linux FUSE; native automatic parsing does not.

juntei auto-parse --e01 -d evidence -o parsed
juntei auto-parse --e01 -d disk.E01 -o parsed
juntei auto-parse --vhdx --e01 -d evidence -o parsed -j timeline.jsonl

Output time zone

Parsed timestamps default to UTC, independent of the analyst computer's local time zone. UTC uses the Windows event-log form 2026-10-20T08:46:38.2001668Z: an ISO 8601 date/time, T between the date and time, and Z for UTC. The available fractional digits are preserved. manifest.json's GeneratedUTC uses this form too. The console's Start time and End time are the analyst computer's local time, such as 2026-11-04 09:15:02, whatever the output time zone.

Choose a fixed display offset with -Z, --timezone:

juntei auto-parse -d evidence/ -o parsed-jst/ --timezone "+09:00"
juntei auto-parse -d evidence/ -o parsed-offset/ -Z "-01:00"
juntei auto-parse -d evidence/ -o parsed-half-hour/ -Z "+02:30"

An offset is a signed, two-digit HH:MM value (hours 00–23, minutes 00–59). Names such as JST, shortened values such as +9, and invalid ranges produce an error with example syntax. Omit the option or use --timezone "+00:00" for UTC. A fixed offset does not apply daylight saving rules.

The option applies to parsed timestamps in the per-artifact CSV, JSON and JSONL results and the additional -j JSONL export. For example, 2026-10-20T08:46:38.2001668Z becomes 2026-10-20T17:46:38.2001668+09:00; both describe the same instant.

Field names stay stable, including existing names ending in UTC. Converted values explicitly carry the selected offset. OutputTimeZone in both manifests records the requested display offset, while GeneratedUTC remains UTC run metadata. Per-parser logs retain the parsers' native UTC summaries.

Raw FILETIME/epoch numbers, registry-value dictionaries, source time-zone configuration, text metadata, date-only values and local clock values without a known offset are preserved. Juntei does not add Z to an unknown local time. FAT-derived shell-item clocks (Item*UTC in ShellBags/OpenSaveMRU and LNK/Jump List TargetItems) have no recorded offset; their legacy UTC labels or rendered Z suffix do not prove UTC, so the offset option preserves them. CSV columns containing free-text summaries retain their recorded text; JSON/JSONL preserves nested parsed timestamps as structured fields.

UTC uses the existing parser output directly. An explicit nonzero offset adds a streaming formatting pass within each parser worker; it changes display values without changing evidence.

If an offset would move a timestamp outside years 0000–9999, that value keeps its original explicit offset. Values with more than nine fractional digits also stay unchanged rather than being rounded. Juntei records a warning in the parser's *-logs.txt file and converts the other timestamps. Malformed CSV/JSON or an output error still fails the task and leaves the affected original result file unchanged.

What it discovers

Juntei searches recursively for directories named Windows that contain a System32, Prefetch, or AppCompat directory, case-insensitively. Recognizing the latter two also supports targeted collections that contain only Prefetch or Amcache. This excludes user-profile directories such as AppData\Roaming\Microsoft\Windows. Nested legacy installations such as C:\Windows.old\Windows are assigned to the outer collected volume instead of becoming duplicate computers. The default maximum depth is 10. This covers common Velociraptor paths such as:

<EVIDENCE>/<collection>/uploads/auto/C%3A/Windows

Change the limit only when the collection is nested more deeply:

juntei auto-parse -d evidence -o parsed --max-depth 15

For each discovered system, the computer name is chosen in this order:

1. hostname in the nearest ancestor client_info.json (with its value retained as FQDN in the manifest).
2. ComputerName in a collected SYSTEM registry hive.
3. The nearest useful collection-directory name, with drive and Velociraptor uploads/auto scaffolding skipped and a suffix such as _F.… removed.

Names are made safe for use as directory names. Duplicate names receive a numeric suffix in both their output directory and Comp value so separate systems remain distinguishable in JSON. The manifest keeps the hostname exactly as discovered in a separate Hostname field.

After listing the systems, auto-parse prints one Timezone: line directly above Parser tasks. It shows the selected output timezone: UTC by default, or a value such as UTC+09:00 when --timezone "+09:00" is used. The label is green and the value uses the terminal's default text color, like the other summary values. -K, --no-color keeps the line plain. Collected systems' time-zone configuration is available in the System Information results.

Parsers it runs

One parser failing does not stop the others. auto-parse runs these jobs for every discovered computer. Jobs use the same source-grouped commands as manual parsing, such as parse-ntfs mft, parse-registry amcache, parse-ese srum, and parse-file prefetch:

• Amcache
• $MFT
• $LogFile NTFS redo/undo records
• Prefetch records and a separate Prefetch execution timeline
• USN Journal
• $I30 directory indexes
• $Boot boot sectors and $Secure:$SDS security descriptors
• SRUM
• User Access Logging (UAL)
• Web browser history, downloads, cookies and form history (Chromium- and Firefox-based browsers)
• Internet Explorer and legacy Edge's WebCache: history, downloads, cookies and cache entries
• Outlook PST, OST, MSG and OFT files: folders, items, recipients, attachments, contacts, calendar items and tasks
• LNK shortcuts
• Jump Lists
• ShimCache
• Persistence Hunter (131 cross-source persistence checks with allow/block profiles)
• Defender quarantine metadata
• Open and Save As dialog history
• all registry keys and values, including recoverable deleted data
• services, RecentDocs, TaskCache, SAM accounts, registry autostart locations, UserAssist, BAM, installed programs, MuiCache, ShellBags, and USB devices
• system information: names, Windows version, time zone, last shutdown, profiles and SIDs
• the audit policy: which security events the system was set to log
• boot configuration (BCD and BCD-Template)
• network profiles, interfaces, shares, port proxies and routes
• LSA secrets' names and times, and cached domain logons in use (nothing is decrypted)

Persistence Hunter retains every severity (--min-severity info), including partial allow matches. LOW is a classification to investigate; missing signature metadata can produce it for malicious commands too. The automatic inventory does not discard these entries using the manual command's default medium threshold.

The hunter uses one worker inside each automatic parser process. This keeps auto-parse -T <N> from multiplying its process budget by another CPU-sized pool in every child. Standalone persistence-hunter -T <N> controls the hunter's own worker threads.

CSV $MFT output includes all timestamps and short names. Registry output includes raw data and a FILETIME interpretation of REG_QWORD values. JSON and JSONL SRUM output includes value-state metadata. Defender files and resident $MFT streams are not extracted automatically.

With --mft-slack, the $MFT output also includes the file names left in the slack of FILE records, as parse-ntfs mft -x writes them: rows marked FromSlack in CSV, and SlackFileNames in JSON and JSONL. --code-page applies to LNK files, Jump Lists, ShellBags and OpenSaveMRU.

An artifact that was not collected is a normal skipped task, not a failure.

Output layout

Results are organized by computer and investigative category. Category directories use PascalCase, such as Accounts and FileAndFolderOpening. Amcache and Jump Lists tables sit directly in their categories with filename prefixes. Computer directory names retain their discovered spelling. Existing output directories are not migrated; choose a new output directory when switching from the older naming. Each parser writes an <artifact>-logs.txt file beside its results, including when the artifact was not collected. CSV keeps separate tables because each artifact has different columns:

<OUTPUT>/
├── manifest.json
├── manifest.csv
├── HOST1/
│   ├── Accounts/
│   │   ├── Registry-LsaSecrets.csv
│   │   ├── Registry-LsaSecrets-logs.txt
│   │   ├── Registry-SAM.csv
│   │   └── Registry-SAM-logs.txt
│   ├── Applications/
│   │   ├── Registry-AppHistory.csv
│   │   ├── Registry-AppHistory-logs.txt
│   │   ├── Registry-InstalledPrograms.csv
│   │   └── Registry-InstalledPrograms-logs.txt
│   ├── BrowserActivity/
│   │   ├── Browser-Cookies.csv
│   │   ├── Browser-Downloads.csv
│   │   ├── Browser-FormHistory.csv
│   │   ├── Browser-History.csv
│   │   ├── Browser-logs.txt
│   │   ├── WebCache-Containers.csv
│   │   ├── WebCache-Cookies.csv
│   │   ├── WebCache-Downloads.csv
│   │   ├── WebCache-Entries.csv
│   │   ├── WebCache-History.csv
│   │   └── WebCache-logs.txt
│   ├── Communication/
│   │   ├── Outlook-Attachments.csv
│   │   ├── Outlook-Calendar.csv
│   │   ├── Outlook-Contacts.csv
│   │   ├── Outlook-Files.csv
│   │   ├── Outlook-Folders.csv
│   │   ├── Outlook-Items.csv
│   │   ├── Outlook-Recipients.csv
│   │   ├── Outlook-Tasks.csv
│   │   └── Outlook-logs.txt
│   ├── ExternalDevices/
│   │   ├── Registry-USB.csv
│   │   └── Registry-USB-logs.txt
│   ├── FileAndFolderOpening/
│   │   ├── JumpLists-AutomaticDestinations.csv
│   │   ├── JumpLists-CustomDestinations.csv
│   │   ├── JumpLists-logs.txt
│   │   ├── LNK.csv
│   │   ├── LNK-logs.txt
│   │   ├── Registry-Office.csv
│   │   ├── Registry-Office-logs.txt
│   │   ├── Registry-MRU.csv
│   │   ├── Registry-MRU-logs.txt
│   │   ├── Registry-OpenSaveMRU.csv
│   │   ├── Registry-OpenSaveMRU-logs.txt
│   │   ├── Registry-RecentDocs.csv
│   │   ├── Registry-RecentDocs-logs.txt
│   │   ├── Registry-ShellBags.csv
│   │   └── Registry-ShellBags-logs.txt
│   ├── FileExistence/
│   │   ├── Registry-Amcache-Devices.csv
│   │   ├── Registry-Amcache-Files.csv
│   │   ├── Registry-Amcache-Findings.csv
│   │   ├── Registry-Amcache-Summary.csv
│   │   ├── Registry-Amcache-logs.txt
│   │   ├── Registry-ShimCache.csv
│   │   └── Registry-ShimCache-logs.txt
│   ├── FileSystem/
│   │   ├── Boot.csv
│   │   ├── Boot-logs.txt
│   │   ├── I30.csv
│   │   ├── I30-logs.txt
│   │   ├── LogFile.csv
│   │   ├── LogFile-logs.txt
│   │   ├── MFT.csv
│   │   ├── MFT-logs.txt
│   │   ├── SecureSDS.csv
│   │   ├── SecureSDS-logs.txt
│   │   ├── UsnJournal.csv
│   │   └── UsnJournal-logs.txt
│   ├── NetworkActivity/
│   │   ├── Registry-Networks.csv
│   │   ├── Registry-Networks-logs.txt
│   │   ├── SRUM-NetworkConnections.csv
│   │   ├── SRUM-NetworkUsages.csv
│   │   └── SRUM-PushNotifications.csv
│   ├── LateralMovement/
│   │   ├── Registry-RemoteAccess.csv
│   │   ├── Registry-RemoteAccess-logs.txt
│   │   ├── UAL-Clients.csv
│   │   ├── UAL-RoleAccess.csv
│   │   ├── UAL-SystemIdentity.csv
│   │   └── UAL-logs.txt
│   ├── Persistence/
│   │   ├── Registry-BCD.csv
│   │   ├── Registry-BCD-logs.txt
│   │   ├── Registry-Persistence.csv
│   │   ├── Registry-Persistence-logs.txt
│   │   ├── Registry-Services.csv
│   │   ├── Registry-Services-logs.txt
│   │   ├── Registry-TaskCache.csv
│   │   └── Registry-TaskCache-logs.txt
│   ├── ProcessExecution/
│   │   ├── Registry-AppCompat.csv
│   │   ├── Registry-AppCompat-logs.txt
│   │   ├── Registry-FeatureUsage.csv
│   │   ├── Registry-FeatureUsage-logs.txt
│   │   ├── Registry-BAM.csv
│   │   ├── Registry-BAM-logs.txt
│   │   ├── Registry-MuiCache.csv
│   │   ├── Registry-MuiCache-logs.txt
│   │   ├── Prefetch.csv
│   │   ├── Prefetch-logs.txt
│   │   ├── PrefetchTimeline.csv
│   │   ├── PrefetchTimeline-logs.txt
│   │   ├── SRUM-AppResourceUseInfo.csv
│   │   ├── SRUM-AppTimelineProvider.csv
│   │   ├── Registry-UserAssist.csv
│   │   └── Registry-UserAssist-logs.txt
│   ├── Registry/
│   │   ├── Registry-Dump.csv
│   │   └── Registry-Dump-logs.txt
│   ├── SecurityProducts/
│   │   ├── Registry-SecuritySettings.csv
│   │   ├── Registry-SecuritySettings-logs.txt
│   │   ├── DefenderQuarantine.csv
│   │   ├── DefenderQuarantine-logs.txt
│   │   └── DefenderQuarantined/  # only with -x
│   └── SystemInformation/
│       ├── Registry-AuditPolicy.csv
│       ├── Registry-AuditPolicy-logs.txt
│       ├── Registry-SystemInfo.csv
│       ├── Registry-SystemInfo-logs.txt
│       ├── SRUM-IdentityMap.csv
│       ├── SRUM-VfuProvider.csv
│       └── SRUM-logs.txt
└── HOST2/
    └── …

Category	Artifacts
Accounts	SAM local accounts, LSA secrets' names and times
Applications	Application history (third-party tools' traces)
Applications	Installed programs
BrowserActivity	Web browser history, downloads, cookies and form history, with recovered deleted entries; Internet Explorer and legacy Edge's WebCache
Communication	Outlook PST, OST, MSG and OFT files: folders, items, recipients, attachments, contacts, calendar items and tasks
ExternalDevices	USB devices and volumes
FileAndFolderOpening	Jump Lists, LNK shortcuts, Microsoft Office, MRU lists, Open and Save As dialogs, RecentDocs, ShellBags
FileExistence	Amcache, ShimCache
FileSystem	$Boot, $I30, $LogFile, $MFT, $Secure:$SDS, USN Journal
NetworkActivity	Network profiles, interfaces, shares, port proxies and routes; SRUM connections, traffic and push notifications
LateralMovement	Users' outbound Remote Desktop, PuTTY and WinSCP connections, mapped drives and shares; User Access Logging (the clients of a server's roles)
Persistence	Boot configuration (BCD), registry autostarts, services, TaskCache
ProcessExecution	Application compatibility, BAM and DAM, FeatureUsage and pins, MuiCache, Prefetch, Prefetch timeline, SRUM application/CPU activity, UserAssist
Registry	General hive keys and values, including recovered records
SecurityProducts	Defender quarantine metadata and optional extracted content; security settings (Defender, UAC, credential protection, RDP, firewall, logging)
SystemInformation	Names, Windows version, time zone, last shutdown, profiles, SIDs and audit policy; SRUM energy/capacity, identity maps and unknown providers

Categories help organize investigations; they are not proof of a particular activity. For example, Amcache and ShimCache entries alone do not establish execution. SRUM records resource usage; consult the artifact guide before drawing conclusions about a program running.

CSV, JSON, and JSONL use the same categories. One <artifact>-logs.txt file per parser job contains its exact command and messages; for example, HOST1/FileSystem/MFT-logs.txt and HOST1/ProcessExecution/Prefetch-logs.txt. JSON and JSONL use the same log filenames. Amcache and Jump Lists each have one shared log beside their prefixed tables. SRUM provider tables are placed directly in NetworkActivity, ProcessExecution and SystemInformation, with a shared SystemInformation/SRUM-logs.txt file. No logs/ subdirectories are created.

Default CSV filenames are Registry-SAM.csv, LNK.csv, Registry-RecentDocs.csv, Registry-ShimCache.csv, LogFile.csv, I30.csv, MFT.csv, UsnJournal.csv, Boot.csv, SecureSDS.csv, Registry-Networks.csv, Registry-Persistence.csv, Registry-Services.csv, Registry-TaskCache.csv, Registry-BCD.csv, Registry-SecuritySettings.csv, PrefetchTimeline.csv, Prefetch.csv, Registry-UserAssist.csv, Registry-AppCompat.csv, Registry-Office.csv, Registry-FeatureUsage.csv, Registry-AppHistory.csv, Registry-MRU.csv, Registry-SystemInfo.csv, Registry-RemoteAccess.csv, Registry-OpenSaveMRU.csv, Registry-InstalledPrograms.csv, Registry-BAM.csv, Registry-MuiCache.csv, Registry-ShellBags.csv, Registry-USB.csv, Registry-SecuritySettings.csv, Registry-AuditPolicy.csv, Registry-Dump.csv, and DefenderQuarantine.csv. Registry-derived tables use the Registry- prefix, including Registry-ShimCache.csv, Registry-UserAssist.csv, Registry-BAM.csv and Registry-SystemInfo.csv. General hive keys and values are in Registry-Dump.csv. Amcache tables are FileExistence/Registry-Amcache-Devices.csv, Registry-Amcache-Files.csv, Registry-Amcache-Findings.csv and Registry-Amcache-Summary.csv. Jump Lists use FileAndFolderOpening/JumpLists-AutomaticDestinations.csv and JumpLists-CustomDestinations.csv. There are no Amcache or Jump Lists subdirectories. SRUM tables use SRUM- filenames directly under their category, for example NetworkActivity/SRUM-NetworkConnections.csv. User Access Logging tables are in LateralMovement, one file per table, such as UAL-Clients.csv and UAL-SystemIdentity.csv, with UAL-logs.txt; see User Access Logging (UAL). Web browser tables are in BrowserActivity: Browser-History.csv, Browser-Downloads.csv, Browser-Cookies.csv and Browser-FormHistory.csv, with Browser-logs.txt; see Web Browsers. Internet Explorer and legacy Edge's WebCache tables are there too: WebCache-History.csv, WebCache-Downloads.csv, WebCache-Cookies.csv, WebCache-Entries.csv and WebCache-Containers.csv, with WebCache-logs.txt; see Internet Explorer and Legacy Edge. Outlook tables are in Communication: Outlook-Files.csv, Outlook-Folders.csv, Outlook-Items.csv, Outlook-Recipients.csv, Outlook-Attachments.csv, Outlook-Contacts.csv, Outlook-Calendar.csv and Outlook-Tasks.csv, with Outlook-logs.txt; see Outlook. See the complete SRUM placement table.

Logs match the capitalized artifact name, such as Registry-SAM-logs.txt, PrefetchTimeline-logs.txt, and Registry-UserAssist-logs.txt. JSON/JSONL files use the same stems, for example MFT.jsonl; the record's Artifact identifier is mft for queries. Multi-table outputs have Registry-Amcache-logs.txt or JumpLists-logs.txt beside their tables. The shared SRUM log is in SystemInformation.

manifest.json records the original discovered Hostname, the unique output/record Comp identity, hostname provenance, evidence paths, artifact Category, command lines, duration, exit code, result path, log path, the requested JSONL timeline and any export error, whether Defender extraction was requested, and whether each task succeeded, was skipped, or failed.

Auto-parse writes no absolute path, so results can be shared without showing where the evidence, the results or Juntei are on the analysis system:

• Evidence paths are relative to the evidence directory. The terminal lists each computer with its directory in the evidence (HOST1: ./HOST1_F), and the parsers run in the evidence directory and are given such paths. The results' source path columns (SourceFile, SourcePath, …), the logs and the manifests' EvidenceRoot and WindowsDirectories show where each file is in the evidence (./HOST1_F/C/Windows/Prefetch/CMD.EXE-6D6290C5.pf).
• The manifests' and logs' result paths (Output, OutputFiles, Log, JSON-Timeline, the output paths in Command) and Defender's ExtractedFile are relative to the output directory (./HOST1/ProcessExecution/Prefetch.csv, ../siem.jsonl for a timeline beside it). Command starts with the program's name (juntei); its evidence paths are relative to the evidence directory and its output paths to the output directory.
• EvidenceDirectory and OutputDirectory are the two directories' names. ManifestVersion 2 marks manifests that record result paths from the output directory; earlier manifests have no ManifestVersion and record them as given to -o. A -C rerun reads both.
• The terminal shows an output or timeline path as given when it is relative, and from the current directory when it is absolute (../results/).

After the number of parallel processes, the terminal shows the total size of the files of the Windows systems found (Total filesize: 26.1 MiB).

The progress message shows the active computer and artifact followed by an approximate input size, for example HOST1 / prefetch (~2.0 MiB). A group of files uses their combined size; each MFT, LogFile or USN Journal task shows its individual input size. Estimates exclude auxiliary transaction logs and enrichment files and do not predict the size of the parsed output.

manifest.csv provides the same task index as a spreadsheet-friendly table, with one row per parser task. It includes Comp, original Hostname, FQDN, HostnameSource, EvidenceRoot, Artifact, Category, OutputType, Purpose, Status, DurationMs, ExitCode, Output, OutputFiles, Log, Error, and Command. Purpose is artifact for the categorized results or json_timeline for the additional native JSONL pass used with CSV. OutputType is the actual parser output format. Command is a JSON array of the executable and its arguments, preserving spaces and quoting. For SRUM, Output is the computer directory, OutputFiles is a JSON array of its exact provider output paths, and Category names the shared log location (SystemInformation). Files are categorized individually; OutputFiles also appears in the JSON manifest.

Filter Status to skipped or failed to find tasks requiring review; a skipped task's Error may be empty, with the explanation in its Log file.

The terminal summary includes the total number and size of regular files currently beneath the output directory, including both manifests, parser logs, and extracted files. Symbolic links are not followed. Sizes scale automatically using the same formatter as Total filesize, with units such as KiB, MiB, and GiB:

Results saved: output/ ( 125 files / 40.5 MiB )

Amcache and SRUM tables use -Source1, -Source2, etc. when several source databases were collected. The shared parser log records the original-to-final paths, and JSON/JSONL records retain source provenance. CSV Amcache/Jump Lists tasks list their exact table paths in manifest OutputFiles; their Output is the investigative category directory. JSON and JSONL Amcache and Jump Lists exports are already single files named Registry-Amcache.json[l] and JumpLists.json[l]. The combined -j timeline keeps the same record contents and Artifact values. --clobber uses the preceding manifest to clear recorded outputs, including earlier names, while preserving unrelated category files. A normal single-volume collection writes $MFT and USN Journal records directly to FileSystem/MFT.csv and FileSystem/UsnJournal.csv. Additional collected volumes use numbered sibling files such as FileSystem/MFT-2.csv and FileSystem/MFT-2-logs.txt.

JSON and SIEM ingestion

Every JSON or JSONL record receives two top-level fields:

• Comp: the source system.
• Artifact: the Juntei parser that produced the record, such as mft or prefetch-timeline.

-j, --json-timeline <FILE> creates one additional JSONL file, regardless of the individual result format. All categorized outputs and their logs are retained:

# Default CSV tables plus a SIEM timeline
juntei auto-parse -d evidence -o parsed -j parsed/timeline.jsonl

# Pretty JSON results plus a SIEM timeline
juntei auto-parse -d evidence -o parsed-json -t json -j parsed-json/timeline.jsonl

# Individual JSONL results plus a consolidated JSONL timeline
juntei auto-parse -d evidence -o parsed-jsonl -t jsonl -j parsed-jsonl/timeline.jsonl

The filename is used as supplied; relative paths are relative to the current working directory. It may be in the output root, another non-reserved output subdirectory, or outside the output directory. Evidence, manifests, per-computer results/logs, and temporary parser directories cannot be used as the destination. An existing file requires -C; a failed export leaves it intact.

In CSV mode, Juntei performs an additional native JSONL pass so the SIEM file preserves numeric and boolean types, nested data, raw fields, and metadata that CSV tables can omit. The extra jobs share the same -T concurrency limit, do not extract quarantine contents again, and have separate *-json-timeline-logs.txt sidecar logs. Both manifests distinguish their purpose and output format. Temporary JSONL files are removed after a successful run; they are retained if a parser or export fails. Plan for the extra processing time and temporary disk space.

In JSON mode, Juntei streams the existing results into compact JSONL without reparsing the evidence. Amcache reports are expanded into the same individual summary, finding, file, and device records as native JSONL. In JSONL mode, the existing annotated records are combined directly. All modes use the same SIEM record structure. The dataset keeps native timestamps and artifact fields; it does not invent a common event timestamp or globally sort heterogeneous artifacts.

jq -c 'select(.Comp == "HOST1" and .Artifact == "prefetch")' parsed/timeline.jsonl
jq -r 'select(.Artifact == "mft") | .FullPath? // empty' parsed/timeline.jsonl

manifest.json records the requested JSON-Timeline path and any JSON-TimelineError. Its task records, and manifest.csv, still point to retained artifact outputs. Successful CSV timeline-only jobs reference the final JSONL file instead of deleted temporary files. If any parser fails, the run exits unsuccessfully and the timeline contains only successful results; inspect the manifests and category logs before treating it as complete. The file-count/size summary covers files inside the output directory; an external timeline is reported separately as JSONL timeline: <FILE>.

Performance

Parser jobs are separate processes, so CPU-heavy artifacts can run at the same time and damage in one parser cannot terminate the complete run. By default, Juntei uses the logical CPU count. Limit concurrency when evidence is on a slow disk or the system has little memory:

juntei auto-parse -d evidence -o parsed -T 4

Usage

Version: 1.1.0 (CODE BLUE Release)
Yamato Security (https://github.com/Yamato-Security/juntei - @SecurityYamato)

Usage:
  juntei auto-parse -d <EVIDENCE> -o <OUTPUT> [OPTIONS]

Input:
  -d, --directory <EVIDENCE>  Evidence directory containing one or more collected Windows systems
      --max-depth <DEPTH>     Maximum directory depth at which to discover a Windows directory [default: 10]
      --vhdx                  Parse VHDX images natively on Linux, macOS and Windows (read-only; temporary disk space required)
      --e01                   Parse E01/Ex01 images natively (split images from their first segment; temporary disk space required)
      --temp-dir <DIR>        Directory for private image staging (default: output filesystem)

Output:
  -o, --output <DIR>                  New directory in which to create per-computer results
  -t, --output-type <TYPE>            Output type: csv (default), json, or jsonl [default: csv]
  -j, --json-timeline <FILE>          Create a single JSONL timeline to import into a SIEM
  -Z, --timezone <OFFSET>             Display parsed timestamps using a fixed UTC offset (UTC by default) [default: +00:00]
  -C, --clobber                       Overwrite outputs in an existing directory (never deletes unrelated files)
  -x, --extract-defender-quarantined  Extract Defender-quarantined files

Performance:
  -T, --threads <N>  Parser processes to run at once (default: logical CPU count)

Parsing:
      --code-page <NUMBER>  Windows code page for ANSI strings in LNK files, Jump Lists, ShellBags and OpenSaveMRU [default: 1252]
      --mft-slack           Recover the file names left in the slack of $MFT records

General Options:
  -h, --help  Show the help menu

Display Settings:
  -K, --no-color  Disable color output
  -q, --quiet     Quiet mode: do not display the launch banner

Use a new output directory when practical. -C removes or overwrites only the exact generated targets for this run, so a now-missing artifact cannot leave a stale result. It does not delete unrelated files or the complete output tree. It also removes each computer's SecurityProducts/DefenderQuarantined/ directory, and the reserved defender-quarantined/ directory from the previous flat layout, before parsing, whether or not the new run uses -x.

Use a fresh output directory when switching from an older flat layout. Earlier CSV/JSON files are not relocated or deleted automatically.

Treat extracted Defender content as malware

-x, --extract-defender-quarantined writes quarantined content to disk under each computer's SecurityProducts/DefenderQuarantined/ directory. Recovered binary streams end in .quarantined, and Juntei removes execute permission. Each binary security descriptor also gets a readable .security_descriptor.txt report with ownership, permissions and SDDL. Never execute recovered payloads. Use an isolated analysis system and expect antivirus or EDR software to alert on or remove the recovered content.

See reading the recovered security descriptor for the report fields and their forensic limitations.

Auto-parse also reads users' remote connections (RDP, PuTTY, WinSCP and mapped drives).

Build a chronological super timeline

After parsing, use super-timeline to expand the recorded timestamps into labeled events. Add --sort to sort them across computers and artifacts:

juntei super-timeline -d output/ -o SuperTimeline.csv --sort

The existing -j, --json-timeline export remains a combined native-record JSONL file. It preserves parser schemas; it does not expand timestamp fields or sort events. Keep it and the individual parser results for evidence-level review.