Example Workflows

Common investigation patterns with accdu_inspector.

1. Standard Scan

python accdu_inspector.py sample.accdu --out ./analysis

2. Marker-Based VBA Extraction

python accdu_inspector.py suspect.accdu --out ./out --dump-markers --extract-from-markers

3. Deep Carving (Aggressive)

python accdu_inspector.py suspect.accdu --out ./out \
  --entropy-threshold 6.8 --min-hex-chars 80 --utf16-min-pairs 50 \
  --merge-gap-chars 128 --merge-gap-bytes 128

4. YARA-Enhanced DFIR Scan

python accdu_inspector.py ./samples --out ./out --yara ./rules