BitsParser: parse Windows Background Intelligent Transfer Service database files
A python tool to parse Windows Background Intelligent Transfer Service database files.
BitsParser is a Python 3 script that can parse Windows Background Intelligent Transfer Service database files and extract job and file information. It supports both the original custom database format as well as the ESE database format used on Windows 10 systems.
BitsParser is written in Python 3. It will run on any platform Python supports, though SID resolution will only work on Windows.
Before running the tool, you will have to install the required packages defined in requirements.txt. To do this, run the following command (may require administrator-level privileges):
git clone https://github.com/fireeye/BitsParser.git
pip install -r requirements.txt
By default, it will process files in the %ALLUSERSPROFILE%\Microsoft\Network\Downloader. Use the -i option to specify an alternate file or directory. The script can be used with offline files from alternate operating systems.
By default, it will output the parsing results in JSON format to stdout. To direct the output to a file, use the -o option.
By default, it will only parse and output active jobs and files. To carve deleted entries from the database use –carvedb. To carve entries from all file types, including transaction logs, use –carveall.
Below is a simple example showing how the BitsParser tool is run and what the output looks like:
Copyright 2021 FireEye, Inc.