Juntei

What it is

A Rust command-line program from Yamato Security, and a sibling of Hayabusa for Windows artifacts that are not event logs. It auto-parses collected hosts, reads VHDX and E01 or Ex01 images without mounting them, and can build a Timesketch-ready super timeline.

What it helps with

- Parsing artifacts such as Prefetch, the MFT, registry hives, and browser history
- Reading VHDX and E01 images natively without an OS mount
- Hunting persistence across registry autostarts, scheduled tasks, WMI, and BITS

Who it's for

Incident responders examining Windows evidence they own or are authorized to examine.

Worth knowing

It does not parse Windows event logs; pair it with Hayabusa for .evtx events. RPL-1.5 requires you to share changes when you deploy the tool beyond personal or research use, including inside an organization.

Does it run on Linux or macOS?
Yes. Prebuilt binaries cover Windows, Linux, and macOS on Intel and ARM.

Does the super timeline replace my parsed files?
No. It does not replace parsed records, original evidence, or a native Plaso storage file.

How does it compare with Hayabusa, Timesketch, and Plaso?
In our view Hayabusa covers Windows event logs, Timesketch can import the Timesketch-profile output, and Plaso is a broader super-timeline engine.