Windows Event Log (EVTX)
| Format | Windows Event Log (EVTX) |
|---|---|
| Short name | EVTX |
| Category | log |
| Platforms | Windows |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Windows structured event log format used since Vista/Server 2008, stored under C:\Windows\System32\winevt\Logs\. A 4 KB file header is followed by 64 KB chunks ('ElfChnk') of binary XML event records; records can remain in chunk free space and be recovered. Key forensic sources: Security.evtx (logons 4624/4625, account changes, privilege use 4672), System.evtx (service installs, crashes, boot events), Microsoft-Windows-PowerShell (4103/4104 script block logging), Microsoft-Windows-Sysmon (process creation, network, file events). Event ID 1102 (Security log cleared) and 104 (in System: another log cleared) are significant anti-forensic indicators. Note: event messages are not stored in the EVTX file itself — they are resolved via provider DLLs at display time. Copying EVTX files off-system may result in unresolvable messages without a message database.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 45 6C 66 46 69 6C 65 00 | ElfFile. | EVTX file signature ('ElfFile') |
Known extensions
.evtx
References
- EVTX format specification (libevtx) https://github.com/libyal/libevtx/blob/main/documentation/Windows%20XML%20Event%20Log%20(EVTX).asciidoc
- ForensicsWiki — Windows XML Event Log (EVTX) https://forensics.wiki/windows_xml_event_log_(evtx)/
- Forensic analysis of Windows 10 and 11 event logs (ElcomSoft, Oleg Afonin, 2026) https://blog.elcomsoft.com/2026/02/forensic-analysis-of-windows-10-and-11-event-logs/
- EVTX and message resolution (Velociraptor docs) https://docs.velociraptor.app/docs/forensic/event_logs/
Cite this entry
Crush Format Reference, “Windows Event Log (EVTX)”. https://kalink0.github.io/crush-forensics/formats/evtx/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction