Windows Event Log Format Documentation: Windows XML Event Log (EVTX)

= Windows XML Event Log (EVTX) format
Analysis of EVTX

:toc:
:toclevels: 4

:numbered!:
[abstract]
== Summary

The Windows XML EventLog (EVTX) format is used by Microsoft Windows to store
system log information. This specification is based the work done by A.
Schuster `[SCHUSTER11]` and on `[MS-EVEN6]`. It was complemented by other
public available information and was enhanced by analyzing test data.

This document is intended as a working document of the data format specification
for the libevtx project.

Special thanks to A. Schuster for his excellent work on the format and test
files.

[preface]
== Document information

[cols="1,5"]
|===
| Author(s): | Joachim Metz <joachim.metz@gmail.com>
| Abstract: | This document contains information about the Windows XML Event Viewer Log (EVTX) format.
| Classification: | Public
| Keywords: | Windows XML Event Viewer Log, EVTX
|===

[preface]
== License

....
Copyright (C) 2011-2024, Joachim Metz <joachim.metz@gmail.com>.
Permission is granted to copy, distribute and/or modify this document under the
terms of the GNU Free Documentation License, Version 1.3 or any later version
published by the Free Software Foundation; with no Invariant Sections, no
Front-Cover Texts, and no Back-Cover Texts. A copy of the license is included
in the section entitled "GNU Free Documentation License".
....

[preface]
== Revision history

[cols="1,1,1,5",options="header"]
|===
| Version | Author | Date | Comments
| 0.0.1 | J.B. Metz | September 2011 | Initial version.
| 0.0.2 | J.B. Metz | March 2012 +
April 2012 | Additional information.
| 0.0.3 | J.B. Metz | May 2012 | Additional information.
| 0.0.4 | J.B. Metz | May 2012 | Updates for Windows 8 Consumer Preview.
| 0.0.5 | J.B. Metz | October 2012 | Additional information regarding formatted messages.
| 0.0.6 | J.B. Metz | December 2012 | Additional information regarding formatted messages.
| 0.0.7 | J.B. Metz | February 2013 | Additional information regarding formatted messages.
| 0.0.8 | J.B. Metz | February 2013 | Additional information regarding chunk offset values seen in archived EVTX files with thanks to R. Rumble.
| 0.0.8 | J.B. Metz | February 2013 | Additional information regarding corruption scenarios.
| 0.0.9 | J.B. Metz | March 2013 | Additional information regarding corruption scenarios.
| 0.0.10 | J.B. Metz | May 2013 | Additional information regarding corruption scenarios.
| 0.0.11 | J.B. Metz | July 2013 | Additional information regarding XML escaping with thanks to G. Torres.
| 0.0.12 | J.B. Metz | July 2013 | Additional information regarding ProcessingErrorData.
| 0.0.13 | J.B. Metz | July 2013 | Additional information regarding dirty file with invalid number of chunks corruption scenario with thanks to G. Torres.
| 0.0.14 | J.B. Metz | October 2013 | Added information about parameter expansion.
| 0.0.15 | J.B. Metz | February 2014 | Additional information regarding MUI and "language specific" event message files.
| 0.0.16 | J.B. Metz | July 2014 | Additional information about parameter expansion.
| 0.0.16 | J.B. Metz | March 2015 | Switched to asccidoc format.
| 0.0.17 | J.B. Metz | January 2016 | Additional information about Binary XML type (0x21).
| 0.0.18 | J.B. Metz | April 2016 | Fixed typo.
| 0.0.19 | J.B. Metz | November 2020 | Changes for formatting.
| 0.0.20 | J.B. Metz | May 2021 | Textual and formatting changes.
| 0.0.21 | J.B. Metz | Octoboer 2021 | Additional information regarding format versions.
| 0.0.22 | J.B. Metz | December 2021 | Additional information about MUI language neutral file.
| 0.0.23 | J.B. Metz | December 2023 | Updated references and additional information about SystemResources directory.
| 0.0.24 | J.B. Metz | January 2024 | Additional information about parameter message files.
| 0.0.25 | J.B. Metz | April 2024 | Additional information about dependency identifier.
| 0.0.26 | J.B. Metz | September 2024 | Additional information regarding format edge case with thanks to J. Solomon.
|===

:numbered:
== Overview

The Windows XML EventLog (EVTX) format is used by Microsoft Windows, as of
Windows Vista, to store system log information.

The EVTX format supersedes the Windows EventLog (EVT) format as used in Windows
XP.

An EVTX file consists of:

* file header
* chunks
* trailing empty values

[cols="1,5",options="header"]
|===
| Characteristics | Description
| Byte order | little-endian
| Date and time values | FILETIME in UTC
| Character strings | ASCII strings are Single Byte Character (SBC) or Multi Byte Character (MBC) string stored with a codepage. Sometimes referred to as ANSI string representation. +
Though technically maybe incorrect, this document will use term (extended) ASCII string. +
Unicode strings are stored in UTF-16 little-endian without the byte order mark (BOM).
|===

=== Test version

The following version of programs were used to test the information within this document:

* Windows Vista
* Windows 2008
* Windows 7
* Windows 8
* [yellow-background]*TODO: Windows 2012*
* Windows 10 (1903, 1909, 2004, 20H2)
* Windows 11 (21H2)

=== Event Log files

The event logs files can normally be found in:

....
C:\Windows\System32\winevt\Logs\
....

[cols="1,3",options="header"]
|===
| Filename | Description
| Application.evtx | Application events
| DFS Replication.evtx | [yellow-background]*TODO*
| HardwareEvents.evtx | [yellow-background]*TODO*
| Internet Explorer.evtx | Internet Explorer events
| Key Management Service.evtx | [yellow-background]*TODO*
| Media Center.evtx | [yellow-background]*TODO*
| Microsoft-Windows-Bits-Client%4Operational.evtx | [yellow-background]*TODO*
| Microsoft-Windows-CodeIntegrity%4Operational.evtx | [yellow-background]*TODO*
| Microsoft-Windows-CorruptedFileRecovery-Client%4Operational.evtx | [yellow-background]*TODO*
| Microsoft-Windows-CorruptedFileRecovery-Server%4Operational.evtx | [yellow-background]*TODO*
| Microsoft-Windows-DateTimeControlPanel%4Operational.evtx | [yellow-background]*TODO*
| Microsoft-Windows-Diagnosis-DPS%4Operational.evtx | [yellow-background]*TODO*
| Microsoft-Windows-Diagnosis-PLA%4Operational.evtx | [yellow-background]*TODO*
| Microsoft-Windows-Diagnostics-Networking%4Operational.evtx | [yellow-background]*TODO*
| Microsoft-Windows-Diagnostics-Performance%4Operational.evtx | [yellow-background]*TODO*
| Microsoft-Windows-DiskDiagnostic%4Operational.evtx | [yellow-background]*TODO*
| Microsoft-Windows-DiskDiagnosticDataCollector%4Operational.evtx | [yellow-background]*TODO*
| Microsoft-Windows-DiskDiagnosticResolver%4Operational.evtx | [yellow-background]*TODO*
| Microsoft-Windows-DriverFrameworks-UserMode%4Operational.evtx | [yellow-background]*TODO*
| Microsoft-Windows-Forwarding%4Operational.evtx | [yellow-background]*TODO*
| Microsoft-Windows-GroupPolicy%4Operational.evtx | [yellow-background]*TODO*
| Microsoft-Windows-Help%4Operational.evtx | [yellow-background]*TODO*
| Microsoft-Windows-International%4Operational.evtx | [yellow-background]*TODO*
| Microsoft-Windows-Kernel-WDI