Evtx Magic

Hopefully this snippet will find its way into the next version of file(1).

0       string  ElfFile\0       Vista Event Log (.evtx)
>0x2a   leshort x               \b, %d chunks
>>0x10  lelong  x               \b (no. %d in use)
>0x18   lelong  >1              \b, next record no. %d
>0x18   lelong  =1              \b, empty
>0x78   lelong  &1              \b, DIRTY
>0x78   lelong  &2              \b, FULL

And here's some sample output:

• an ordinary log file:
  System.evtx: Vista Event Log (.evtx), 6 chunks (no. 5 active), next record no. 744


• log obtained while the system was running:
  Anwendung.evtx: Vista Event Log (.evtx), 2 chunks (no. 1 active), next record no. 171, DIRTY


• log wrapped around, the 2nd chunk (counter starts at 0!) is currently reused:
  sample4.evtx: Vista Event Log (.evtx), 16 chunks (no. 1 in use), next record no. 5276


• overflown log file:
  sample6.evtx: Vista Event Log (.evtx), 16 chunks (no. 15 in use), next record no. 4260, FULL