EVTX
Definition
The XML-based binary event log format introduced in Windows Vista. Files live under C:\Windows\System32\winevt\Logs and are parsed with the Windows Event Viewer or EvtxECmd.
- Introduced
- Windows Vista
- Structure
- XML-based binary event log format
- Location
- C:\Windows\System32\winevt\Logs
- Parsing tools
- Windows Event Viewer, EvtxECmd
Common questions
What format did EVTX replace?+
It replaced the older EVT format used in Windows 2000, XP, and Server 2003, which used a simpler binary structure without the XML-based event schema.
Why do investigators prefer a dedicated tool like EvtxECmd over the built-in Event Viewer?+
EvtxECmd can batch-parse many EVTX files at once, output structured formats such as CSV for timeline tools, and apply maps that decode event fields the Event Viewer displays only in raw form, which speeds up large-scale log review.
Related terms
- Amcache.hve
- A registry hive that records application install and execution metadata, including SHA-1 of executables, useful long after the original file is deleted.
- KAPE
- Kroll Artifact Parser and Extractor: a triage framework that selectively collects forensic artefacts from a live or imaged system and parses them...
- Prefetch
- A Windows performance subsystem that records executable launches and the files they touch in the first 10 seconds of execution. The .pf...
- Registry Hive
- A binary file on disk that holds part of the Windows registry. The five logical roots map to physical hive files at...
- UserAssist
- A registry-tracked, ROT13-obfuscated record of GUI program launches per user, with run count and last-execution timestamp.