EVTX
Definition
The XML-based binary event log format introduced in Windows Vista. Files live under C:\Windows\System32\winevt\Logs and are parsed with the Windows Event Viewer or EvtxECmd.
Related terms
- Amcache.hve
- A registry hive that records application install and execution metadata, including SHA-1 of executables, useful long after the original file is deleted.
- KAPE
- Kroll Artifact Parser and Extractor: a triage framework that selectively collects forensic artefacts from a live or imaged system and parses them...
- Prefetch
- A Windows performance subsystem that records executable launches and the files they touch in the first 10 seconds of execution. The .pf...
- Registry Hive
- A binary file on disk that holds part of the Windows registry. The five logical roots map to physical hive files at...
- UserAssist
- A registry-tracked, ROT13-obfuscated record of GUI program launches per user, with run count and last-execution timestamp.
Explained in
- Windows Forensic Artifacts I: Registry, Event Logs and PrefetchThe XML-based binary event log format introduced in Windows Vista. Files live under C:\Windows\System32\winevt\Logs and are parsed with the Windows Event Viewe...