Windows Event Trace Log (ETL)
| Format | Windows Event Trace Log (ETL) |
|---|---|
| Short name | ETL |
| Category | log |
| Platforms | Windows |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
The file format of Event Tracing for Windows (ETW) sessions, including the kernel logger. The undocumented container consists of fixed-size buffers, each with a buffer header, holding events of different providers (manifest-based, TraceLogging or MOF); decoding events requires the provider's schema. AutoLogger sessions write by default to %SystemRoot%\System32\LogFiles\WMI\<session>.etl (optionally with a per-boot counter). ETL files are also produced by diagnostic and network tracing (e.g. network captures recorded with netsh trace) and can contain system, network and application activity not recorded in the event logs. No fixed file signature.
Signatures
None recorded
Known extensions
.etl
References
- Configuring and Starting an AutoLogger Session (Microsoft) https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session
- etl-parser — Event Trace Log reader (Airbus CERT) https://github.com/airbus-cert/etl-parser
Cite this entry
Crush Format Reference, “Windows Event Trace Log (ETL)”. https://kalink0.github.io/crush-forensics/formats/etl/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction