windowssecuritytpm

How to parse/read log files generated from tpmtool.exe (Windows)

As described here https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/tpmtool I can generate a log via the command 'tpmtool.exe gatherlogs' which creates a binary file. How can I parse the generated binary log file "SRTMBoot.dat" so that I get human readable content?

I searched for parser tools which can parse TPM logs but it seems they only exist on linux.

Solution

  • I have used TCGLogTools (a powershell based parser) in the past.

    With this tool you can convert the logs in readable json files:

    PS> tpmtool gatherlogs s:\temp\tpm
PS> ConvertTo-TCGEventLog -LogPath s:\temp\tpm\SRTMBoot.dat | ConvertTo-Json -Depth 8 | Out-File 's:\temp\tpm\SRTMBoot.json'