%FILES%
usr/
usr/bin/
usr/bin/dftimewolf
usr/share/
usr/share/dftimewolf/
usr/share/dftimewolf/ACKNOWLEDGEMENTS
usr/share/dftimewolf/AUTHORS
usr/share/dftimewolf/config/
usr/share/dftimewolf/config/e2e/
usr/share/dftimewolf/config/e2e/e2e_grr_artifact_hosts.sh
usr/share/dftimewolf/config/e2e/jenkins_dftimewolf_install.sh
usr/share/dftimewolf/data/
usr/share/dftimewolf/data/TelemetryTable.ddl
usr/share/dftimewolf/data/config.json
usr/share/dftimewolf/data/recipes/
usr/share/dftimewolf/data/recipes/aws_disk_to_gcp.json
usr/share/dftimewolf/data/recipes/aws_forensics.json
usr/share/dftimewolf/data/recipes/aws_logging_collect.json
usr/share/dftimewolf/data/recipes/aws_logging_ts.json
usr/share/dftimewolf/data/recipes/azure_forensics.json
usr/share/dftimewolf/data/recipes/azure_logging_collect.json
usr/share/dftimewolf/data/recipes/azure_logging_ts.json
usr/share/dftimewolf/data/recipes/bigquery_collect.json
usr/share/dftimewolf/data/recipes/bigquery_ts.json
usr/share/dftimewolf/data/recipes/gce_disk_copy.json
usr/share/dftimewolf/data/recipes/gce_disk_export.json
usr/share/dftimewolf/data/recipes/gcp_cloud_resource_tree.json
usr/share/dftimewolf/data/recipes/gcp_cloud_resource_tree_offline.json
usr/share/dftimewolf/data/recipes/gcp_disk_export_dd.json
usr/share/dftimewolf/data/recipes/gcp_forensics.json
usr/share/dftimewolf/data/recipes/gcp_logging_cloudaudit_ts.json
usr/share/dftimewolf/data/recipes/gcp_logging_cloudsql_ts.json
usr/share/dftimewolf/data/recipes/gcp_logging_collect.json
usr/share/dftimewolf/data/recipes/gcp_logging_gce_instance_ts.json
usr/share/dftimewolf/data/recipes/gcp_logging_gce_ts.json
usr/share/dftimewolf/data/recipes/gcp_logging_ts.json
usr/share/dftimewolf/data/recipes/gdrive_collect.json
usr/share/dftimewolf/data/recipes/grr_artifact_ts.json
usr/share/dftimewolf/data/recipes/grr_files_collect.json
usr/share/dftimewolf/data/recipes/grr_flow_collect.json
usr/share/dftimewolf/data/recipes/grr_hunt_artifacts.json
usr/share/dftimewolf/data/recipes/grr_hunt_file.json
usr/share/dftimewolf/data/recipes/grr_hunt_osquery.json
usr/share/dftimewolf/data/recipes/grr_huntresults_ts.json
usr/share/dftimewolf/data/recipes/grr_osquery_flow.json
usr/share/dftimewolf/data/recipes/grr_timeline_ts.json
usr/share/dftimewolf/data/recipes/grr_yarascan.json
usr/share/dftimewolf/data/recipes/gsheets_ts.json
usr/share/dftimewolf/data/recipes/openrelik_ts.json
usr/share/dftimewolf/data/recipes/plaso_ts.json
usr/share/dftimewolf/data/recipes/recipe-list.md
usr/share/dftimewolf/data/recipes/ts_collect.json
usr/share/dftimewolf/data/recipes/upload_gdrive.json
usr/share/dftimewolf/data/recipes/upload_ts.json
usr/share/dftimewolf/data/recipes/upload_web_ts.json
usr/share/dftimewolf/data/recipes/vt_evtx.json
usr/share/dftimewolf/data/recipes/vt_evtx_ts.json
usr/share/dftimewolf/data/recipes/vt_pcap.json
usr/share/dftimewolf/data/recipes/workspace_collect.json
usr/share/dftimewolf/data/recipes/workspace_meet_ts.json
usr/share/dftimewolf/data/recipes/workspace_user_activity_ts.json
usr/share/dftimewolf/data/recipes/workspace_user_device_ts.json
usr/share/dftimewolf/data/recipes/workspace_user_drive_ts.json
usr/share/dftimewolf/data/recipes/workspace_user_login_ts.json
usr/share/dftimewolf/dftimewolf/
usr/share/dftimewolf/dftimewolf/__init__.py
usr/share/dftimewolf/dftimewolf/cli/
usr/share/dftimewolf/dftimewolf/cli/__init__.py
usr/share/dftimewolf/dftimewolf/cli/dftimewolf_recipes.py
usr/share/dftimewolf/dftimewolf/config.py
usr/share/dftimewolf/dftimewolf/lib/
usr/share/dftimewolf/dftimewolf/lib/__init__.py
usr/share/dftimewolf/dftimewolf/lib/args_validator.py
usr/share/dftimewolf/dftimewolf/lib/auth.py
usr/share/dftimewolf/dftimewolf/lib/cache.py
usr/share/dftimewolf/dftimewolf/lib/collectors/
usr/share/dftimewolf/dftimewolf/lib/collectors/__init__.py
usr/share/dftimewolf/dftimewolf/lib/collectors/audit_log_pb2.py
usr/share/dftimewolf/dftimewolf/lib/collectors/aws.py
usr/share/dftimewolf/dftimewolf/lib/collectors/aws_logging.py
usr/share/dftimewolf/dftimewolf/lib/collectors/aws_snapshot_s3_copy.py
usr/share/dftimewolf/dftimewolf/lib/collectors/aws_volume_snapshot.py
usr/share/dftimewolf/dftimewolf/lib/collectors/azure.py
usr/share/dftimewolf/dftimewolf/lib/collectors/azure_logging.py
usr/share/dftimewolf/dftimewolf/lib/collectors/bigquery.py
usr/share/dftimewolf/dftimewolf/lib/collectors/filesystem.py
usr/share/dftimewolf/dftimewolf/lib/collectors/gce_disk_copy.py
usr/share/dftimewolf/dftimewolf/lib/collectors/gcp_logging.py
usr/share/dftimewolf/dftimewolf/lib/collectors/gdrive.py
usr/share/dftimewolf/dftimewolf/lib/collectors/grr_base.py
usr/share/dftimewolf/dftimewolf/lib/collectors/grr_hosts.py
usr/share/dftimewolf/dftimewolf/lib/collectors/grr_hunt.py
usr/share/dftimewolf/dftimewolf/lib/collectors/gsheets.py
usr/share/dftimewolf/dftimewolf/lib/collectors/osquery.py
usr/share/dftimewolf/dftimewolf/lib/collectors/timesketch.py
usr/share/dftimewolf/dftimewolf/lib/collectors/virustotal.py
usr/share/dftimewolf/dftimewolf/lib/collectors/workspace_audit.py
usr/share/dftimewolf/dftimewolf/lib/collectors/yara.py
usr/share/dftimewolf/dftimewolf/lib/containers/
usr/share/dftimewolf/dftimewolf/lib/containers/__init__.py
usr/share/dftimewolf/dftimewolf/lib/containers/containers.py
usr/share/dftimewolf/dftimewolf/lib/containers/interface.py
usr/share/dftimewolf/dftimewolf/lib/containers/manager.py
usr/share/dftimewolf/dftimewolf/lib/enhancers/
usr/share/dftimewolf/dftimewolf/lib/enhancers/__init__.py
usr/share/dftimewolf/dftimewolf/lib/errors.py
usr/share/dftimewolf/dftimewolf/lib/exporters/
usr/share/dftimewolf/dftimewolf/lib/exporters/__init__.py
usr/share/dftimewolf/dftimewolf/lib/exporters/df_to_filesystem.py
usr/share/dftimewolf/dftimewolf/lib/exporters/gce_disk_export.py
usr/share/dftimewolf/dftimewolf/lib/exporters/gce_disk_export_base.py
usr/share/dftimewolf/dftimewolf/lib/exporters/gce_disk_export_dd.py
usr/share/dftimewolf/dftimewolf/lib/exporters/gce_disk_from_image.py
usr/share/dftimewolf/dftimewolf/lib/exporters/gce_image_from_disk.py
usr/share/dftimewolf/dftimewolf/lib/exporters/gcs_to_gce_image.py
usr/share/dftimewolf/dftimewolf/lib/exporters/gdrive.py
usr/share/dftimewolf/dftimewolf/lib/exporters/local_filesystem.py
usr/share/dftimewolf/dftimewolf/lib/exporters/s3_to_gcs.py
usr/share/dftimewolf/dftimewolf/lib/exporters/timesketch.py
usr/share/dftimewolf/dftimewolf/lib/logging_utils.py
usr/share/dftimewolf/dftimewolf/lib/module.py
usr/share/dftimewolf/dftimewolf/lib/modules/
usr/share/dftimewolf/dftimewolf/lib/modules/__init__.py
usr/share/dftimewolf/dftimewolf/lib/modules/manager.py
usr/share/dftimewolf/dftimewolf/lib/modules/module_runner.py
usr/share/dftimewolf/dftimewolf/lib/preflights/
usr/share/dftimewolf/dftimewolf/lib/preflights/__init__.py
usr/share/dftimewolf/dftimewolf/lib/preflights/cloud_token.py
usr/share/dftimewolf/dftimewolf/lib/preflights/ssh_multiplexer.py
usr/share/dftimewolf/dftimewolf/lib/processors/
usr/share/dftimewolf/dftimewolf/lib/processors/__init__.py
usr/share/dftimewolf/dftimewolf/lib/processors/gce_forensics_vm.py
usr/share/dftimewolf/dftimewolf/lib/processors/gcp_cloud_resource_tree.py
usr/share/dftimewolf/dftimewolf/lib/processors/gcp_cloud_resource_tree_helper.py
usr/share/dftimewolf/dftimewolf/lib/processors/gcp_logging_timesketch.py
usr/share/dftimewolf/dftimewolf/lib/processors/llm_base.py
usr/share/dftimewolf/dftimewolf/lib/processors/llmproviders/
usr/share/dftimewolf/dftimewolf/lib/processors/llmproviders/__init__.py
usr/share/dftimewolf/dftimewolf/lib/processors/llmproviders/gemini.py
usr/share/dftimewolf/dftimewolf/lib/processors/llmproviders/interface.py
usr/share/dftimewolf/dftimewolf/lib/processors/llmproviders/manager.py
usr/share/dftimewolf/dftimewolf/lib/processors/llmproviders/ollama.py
usr/share/dftimewolf/dftimewolf/lib/processors/llmproviders/vertex_ai.py
usr/share/dftimewolf/dftimewolf/lib/processors/localplaso.py
usr/share/dftimewolf/dftimewolf/lib/processors/openrelik.py
usr/share/dftimewolf/dftimewolf/lib/processors/workspace_audit_timesketch.py
usr/share/dftimewolf/dftimewolf/lib/processors/workspace_format_strings.json
usr/share/dftimewolf/dftimewolf/lib/recipes/
usr/share/dftimewolf/dftimewolf/lib/recipes/__init__.py
usr/share/dftimewolf/dftimewolf/lib/recipes/manager.py
usr/share/dftimewolf/dftimewolf/lib/resources.py
usr/share/dftimewolf/dftimewolf/lib/telemetry.py
usr/share/dftimewolf/dftimewolf/lib/timesketch_utils.py
usr/share/dftimewolf/dftimewolf/lib/utils.py
usr/share/dftimewolf/dftimewolf/lib/validators/
usr/share/dftimewolf/dftimewolf/lib/validators/__init__.py
usr/share/dftimewolf/dftimewolf/lib/validators/aws_region.py
usr/share/dftimewolf/dftimewolf/lib/validators/azure_region.py
usr/share/dftimewolf/dftimewolf/lib/validators/datetime_validator.py
usr/share/dftimewolf/dftimewolf/lib/validators/gcp_zone.py
usr/share/dftimewolf/dftimewolf/lib/validators/grr_host.py
usr/share/dftimewolf/dftimewolf/lib/validators/hostname.py
usr/share/dftimewolf/dftimewolf/lib/validators/integer.py
usr/share/dftimewolf/dftimewolf/lib/validators/manager.py
usr/share/dftimewolf/dftimewolf/lib/validators/regex.py
usr/share/dftimewolf/dftimewolf/lib/validators/subnet.py
usr/share/dftimewolf/dftimewolf/lib/validators/url.py
usr/share/dftimewolf/dftimewolf/lib/validators/uuid.py
usr/share/dftimewolf/docs/
usr/share/dftimewolf/docs/_static/
usr/share/dftimewolf/docs/_static/graphviz/
usr/share/dftimewolf/docs/_static/graphviz/aws_disk_to_gcp.png
usr/share/dftimewolf/docs/_static/graphviz/aws_forensics.png
usr/share/dftimewolf/docs/_static/graphviz/aws_logging_collect.png
usr/share/dftimewolf/docs/_static/graphviz/aws_logging_ts.png
usr/share/dftimewolf/docs/_static/graphviz/aws_turbinia_ts.png
usr/share/dftimewolf/docs/_static/graphviz/azure_forensics.png
usr/share/dftimewolf/docs/_static/graphviz/azure_logging_collect.png
usr/share/dftimewolf/docs/_static/graphviz/azure_logging_ts.png
usr/share/dftimewolf/docs/_static/graphviz/bigquery_collect.png
usr/share/dftimewolf/docs/_static/graphviz/bigquery_ts.png
usr/share/dftimewolf/docs/_static/graphviz/gce_disk_copy.png
usr/share/dftimewolf/docs/_static/graphviz/gce_disk_export.png
usr/share/dftimewolf/docs/_static/graphviz/gce_disk_export_dd.png
usr/share/dftimewolf/docs/_static/graphviz/gcp_cloud_resource_tree.png
usr/share/dftimewolf/docs/_static/graphviz/gcp_cloud_resource_tree_offline.png
usr/share/dftimewolf/docs/_static/graphviz/gcp_forensics.png
usr/share/dftimewolf/docs/_static/graphviz/gcp_logging_cloudaudit_ts.png
usr/share/dftimewolf/docs/_static/graphviz/gcp_logging_cloudsql_ts.png
usr/share/dftimewolf/docs/_static/graphviz/gcp_logging_collect.png
usr/share/dftimewolf/docs/_static/graphviz/gcp_logging_gce_instance_ts.png
usr/share/dftimewolf/docs/_static/graphviz/gcp_logging_gce_ts.png
usr/share/dftimewolf/docs/_static/graphviz/gcp_turbinia_disk_copy_ts.png
usr/share/dftimewolf/docs/_static/graphviz/gcp_turbinia_ts.png
usr/share/dftimewolf/docs/_static/graphviz/gcp_turbinia_ts_threaded.png
usr/share/dftimewolf/docs/_static/graphviz/grr_artifact_grep.png
usr/share/dftimewolf/docs/_static/graphviz/grr_artifact_ts.png
usr/share/dftimewolf/docs/_static/graphviz/grr_files_collect.png
usr/share/dftimewolf/docs/_static/graphviz/grr_flow_collect.png
usr/share/dftimewolf/docs/_static/graphviz/grr_hunt_artifacts.png
usr/share/dftimewolf/docs/_static/graphviz/grr_hunt_file.png
usr/share/dftimewolf/docs/_static/graphviz/grr_hunt_osquery.png
usr/share/dftimewolf/docs/_static/graphviz/grr_huntresults_ts.png
usr/share/dftimewolf/docs/_static/graphviz/grr_osquery_flow.png
usr/share/dftimewolf/docs/_static/graphviz/grr_timeline_ts.png
usr/share/dftimewolf/docs/_static/graphviz/grr_yarascan.png
usr/share/dftimewolf/docs/_static/graphviz/gsheets_ts.png
usr/share/dftimewolf/docs/_static/graphviz/plaso_ts.png
usr/share/dftimewolf/docs/_static/graphviz/upload_ts.png
usr/share/dftimewolf/docs/_static/graphviz/upload_turbinia.png
usr/share/dftimewolf/docs/_static/graphviz/upload_web_ts.png
usr/share/dftimewolf/docs/_static/graphviz/vt_evtx.png
usr/share/dftimewolf/docs/_static/graphviz/vt_evtx_ts.png
usr/share/dftimewolf/docs/_static/graphviz/vt_pcap.png
usr/share/dftimewolf/docs/_static/graphviz/workspace_logging_collect.png
usr/share/dftimewolf/docs/_static/graphviz/workspace_meet_ts.png
usr/share/dftimewolf/docs/_static/graphviz/workspace_user_activity_ts.png
usr/share/dftimewolf/docs/_static/graphviz/workspace_user_drive_ts.png
usr/share/dftimewolf/docs/_static/graphviz/workspace_user_login_ts.png
usr/share/dftimewolf/docs/_static/logo.png
usr/share/dftimewolf/docs/generate_recipe_doc.py
usr/share/dftimewolf/pyproject.toml
usr/share/dftimewolf/pytype.conf
usr/share/dftimewolf/utils/
usr/share/dftimewolf/utils/__init__.py
usr/share/dftimewolf/utils/check_dependencies.py
usr/share/dftimewolf/utils/dependencies.py
usr/share/dftimewolf/utils/export_machine_startup_script.sh
usr/share/dftimewolf/utils/utils.py
usr/share/doc/
usr/share/doc/dftimewolf/
usr/share/doc/dftimewolf/README.md
usr/share/doc/dftimewolf/architecture.md
usr/share/doc/dftimewolf/developers-guide.md
usr/share/doc/dftimewolf/getting-started.md
usr/share/doc/dftimewolf/index.md
usr/share/doc/dftimewolf/module-writing-basics.md
usr/share/doc/dftimewolf/recipe-caveat.md
usr/share/doc/dftimewolf/recipe-list.md
usr/share/doc/dftimewolf/user-manual.md
