scripts: add evtx_structure.py script
Evtx: fix return type of is_full
ws