Windows Event Log (EVT, legacy)
| Format | Windows Event Log (EVT, legacy) |
|---|---|
| Short name | EVT |
| Category | log |
| Platforms | Windows |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
The binary event log of Windows NT to XP/2003 (AppEvent.Evt, SecEvent.Evt, SysEvent.Evt): a circular buffer of event records with record number, generated and written times (POSIX time, UTC), event ID, source and strings. Records from before a wrap can remain in the file's free space, and since every record carries the 'LfLe' signature, records can also be carved from unallocated space or memory. Superseded by EVTX from Windows Vista on.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 30 00 00 00 4C 66 4C 65 | 0...LfLe | File header: size 0x30 followed by signature 'LfLe' at offset 4 |
| offset unknown | 4C 66 4C 65 | LfLe | Event record signature 'LfLe' at offset 4 of every record |
Known extensions
.evt
References
- Windows Event Viewer Log (EVT) format (libyal/libevt) https://github.com/libyal/libevt/blob/main/documentation/Windows%20Event%20Log%20(EVT)%20format.asciidoc
- Event Log File Format (Microsoft) https://learn.microsoft.com/en-us/windows/win32/eventlog/event-log-file-format
Cite this entry
Crush Format Reference, “Windows Event Log (EVT, legacy)”. https://kalink0.github.io/crush-forensics/formats/evt/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction