.EVTX File Format – File, chunks and records

Windows XML Event Log

Microsoft has not published the EVTX file layout (only the binary XML inside records, in [MS-EVEN6]). This page follows Joachim Metz’s libevtx documentation, Windows XML Event Log (EVTX) format, and the evtx_file_header structure in libevtx’s source, both based on study of real files. All numbers are little-endian. Checksums are the CRC-32 of RFC 1952 with an initial value of 0.

File header

The first 4,096 bytes; libevtx knows the meaning of fields in the first 128 only.

OffsetSizeNameDescription
08SignatureElfFile and a zero byte.
88First chunk numberThe oldest chunk in use.
168Last chunk numberThe newest chunk.
248Next record identifierThe identifier the next event will get.
324Header size128.
362Minor versionFormat 3.1 is seen on Windows Vista and later, 3.2 on Windows 10 (2004) and later.
382Major version3.
402Header block size4,096 (also the offset of the chunk data).
424Number of chunksChunks in the file. A 4-byte field in both libevtx’s documentation and its number_of_chunks[4] structure member. libevtx notes the count can be wrong in dirty files, which Event Viewer appears to correct.
4674–Unknown (empty values).
1204File flags0x1 is dirty; 0x2 is full.
1244ChecksumCRC-32 of the first 120 bytes.
1283,968–Unknown (empty values).

Chunk header

Each chunk is 65,536 bytes, following the 4,096-byte file header: a 512-byte chunk header, an array of event records, then unused space. (libevtx leaves “file size = number of chunks × 65,536 + 4,096” as a check still to confirm.) Records refer to strings and templates inside the same chunk by offsets from the chunk’s start.

OffsetSizeNameDescription
08SignatureElfChnk and a zero byte.
88First event record number–
168Last event record number–
248First event record identifier–
328Last event record identifier–
404Header size128.
444Last event record offsetFrom the start of the chunk.
484Free space offsetFrom the start of the chunk. libevtx: in archived files it sometimes points to the end of the chunk, with zeros after the last record.
524Event records checksumCRC-32 of the event records data.
5664–Unknown (empty values).
1204UnknownPossibly flags.
1244Header checksumCRC-32 of bytes 0–119 and 128–511.
128256Common string offsets64 offsets from the chunk’s start of strings common to the chunk’s records, stored once and referred to by later records (libevtx marks this as not yet confirmed).
384128Template pointers32 32-bit values (libevtx: TemplatePtr, not yet confirmed).

Event record

OffsetSizeNameDescription
04Signature2A 2A 00 00.
44SizeThe record’s size, including the signature and this field.
88Record identifierThe event record identifier.
168Written timeA FILETIME.
24variesEventThe event as binary XML.
end − 44SizeThe size again.