.EVT

Introduction

EVT is the event log format of Windows NT, 2000, XP and Server 2003. The Application, Security and System logs were kept as AppEvent.Evt, SecEvent.Evt and SysEvent.Evt in %SystemRoot%\System32\config. Windows Vista replaced it with EVTX.

The log has a fixed maximum size and works as a ring: when it is full, new records overwrite the oldest. EVT files still turn up in forensic work on old systems, and newer Windows can open and convert them.

Structure

All values are little-endian. The file starts with a 48-byte header. Its first field is the header size, 0x30, followed by the signature LfLe, the version 1.1, the positions of the oldest record and of the end-of-file record, the next and oldest record numbers, the maximum size, flags such as whether the log has wrapped or was not closed cleanly, and the retention time, then the header size again.

Event records follow, each an EVENTLOGRECORD structure: its length, the signature LfLe, the record number, the times the event was generated and written, the event ID, type and category, then the source and computer names as UTF-16 strings, the user’s security ID, the message strings and any binary data, and the length again. Because the log is a ring, records can wrap from the end of the file back to just after the header. A 40-byte end-of-file record, containing the values 0x11111111, 0x22222222, 0x33333333 and 0x44444444, marks where the newest record ends.

Links