01Location
- C:\Windows\System32\winevt\Logs\*.evtx (e.g. Security.evtx, System.evtx, Application.evtx, Microsoft-Windows-TaskScheduler%4Operational.evtx)
- C:\Windows\System32\config\*.evt (Windows 2000, XP, 2003; EVT format)
02Questions it answers
- What did a provider record, on which computer and under which user context?
- Was a service installed (4697) or a scheduled task created (4698)?
- Was the Security log cleared (1102)?
- Are there gaps or inconsistencies in record identifiers or chunk checksums?
03Format and versions
| Format | 4096-byte file header ('ElfFile\0', chunk numbers, next record ID, format version, flags dirty/full, CRC32), followed by 65536-byte chunks ('ElfChnk\0', 512-byte header with common-string and template offsets, CRC32 of header and records) and event records ('**\0\0', size, record identifier, written FILETIME, binary XML as defined in [MS-EVEN6]). |
|---|---|
| Applies to | Windows Vista and later (format 3.1; 3.2 from Windows 10 2004). Earlier systems use the EVT format. |
04Key fields
| Field | What it tells you |
|---|---|
| EventRecordID | Record number assigned when the event was logged. |
| Provider | Provider that logged the event (Name/Guid, or EventSourceName for legacy providers). |
| EventID / Version / Level / Task / Opcode / Keywords | Provider-defined identifiers and classification. |
| TimeCreated | Time stamp identifying when the event was logged (SystemTime or RawTime). |
| Channel / Computer | Log channel and the name of the computer on which the event occurred. |
| Security / Execution | User that logged the event; process and thread that logged it. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| Event record written time | FILETIME (UTC) | Date and time the record was written (logged). |
| TimeCreated (System element) | Event schema time stamp | Logged time exposed in the rendered XML; compare with the record header value. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Collect all .evtx files, including Operational channels, not only Security, System and Application.
- Check file header flags (dirty, full) and chunk CRC32 values before parsing.
- Render messages with provider metadata from the same Windows version as the source system.
- Review record-ID continuity and log-clearing events, then correlate with registry and file system artifacts.
07Interpretation pitfalls
- Event identifiers are not globally unique; they are only meaningful within a specific version of a specific provider.
- Records contain little human-readable text; messages depend on provider templates stored in DLLs and EXEs.
- Many Security events depend on audit policy, e.g. 4697 (Audit Security System Extension) and 4698 (Audit Other Object Access Events).
09Sources
- Windows XML Event Log (EVTX) format libyal / libevtx (J. Metz) · checked 2026-10-14
- Windows Event Log ForensicArtifacts / artifacts-kb · checked 2026-10-14
- SystemPropertiesType Complex Type (event schema) Microsoft Learn · checked 2026-10-14
- 1102(S): The audit log was cleared. Microsoft Learn · checked 2026-10-14
- 4697(S): A service was installed in the system. Microsoft Learn · checked 2026-10-14
- 4698(S): A scheduled task was created. Microsoft Learn · checked 2026-10-14