.EVTX

Introduction

EVTX is the format of the Windows event logs, used since Windows Vista. The System, Application and Security logs, and the logs of many other services, are EVTX files kept in C:\Windows\System32\winevt\Logs. Each event records its source, an event ID, a level, a time and details that depend on the event.

Events are shown as XML, but stored in a compact binary form of XML that reuses templates, so that thousands of similar events take little space. The format replaced the older EVT format of Windows XP.

Software

• Event Viewer, built into Windows
• wevtutil and the PowerShell command Get-WinEvent, built into Windows
• EvtxECmd, Eric Zimmerman’s event log parser (Windows)
• python-evtx, a Python parser (Windows, macOS, Linux)
• Chainsaw, a tool for searching event logs (Windows, macOS, Linux)

Structure

The file starts with a 4096-byte file header beginning ElfFile and a zero byte. It records the first and last chunk numbers, the next record number, the format version, the number of chunks, flags such as whether the log was closed cleanly, and a checksum.

Chunks of 64 KB follow, each starting ElfChnk and a zero byte. A chunk header gives the range of records in the chunk and checksums, and holds tables of the strings and templates its records share. Event records fill the rest of the chunk. Each record starts with the signature 2A 2A 00 00, then its size, record number and time, then the event as binary XML, and ends with its size again.