TIA Parser

This program allows to parse TIA project files and convert them partially into line separated JSON objects or into a Sleuth Kit body file.

The JSON output is only partial since not every aspect of the format can currently be parsed. The missing parts likely do not contain timestamps which is the important information we want this tool to extract for us.

The program can be used by running it like

python3 ./tia-parser.py path/to/project/PEData.plf -j out.json

to generate an JSON output or

python3 ./tia-parser.py path/to/project/PEData.plf -b out.body

to generate a Sleuth Kit body file.

File Format Description

Specifics of the file format are documented in file-format.md.

Missing

Currently this tool does not extract relations between objects.