Category "Vista event log"

By far the largest part of an event record consists of a complex binary XML structure. I'm going to explain its internals in a series of postings. I'm starting with an overview of the XML schema.

I'm excited to release the first version of a template for the 010 Editor which parses the outer structure of a Vista event log file. By "outer structure" I refer to the structures described earlier in this blog, from the file level down to the single record. However, the template can not yet decode the binary XML inside of an event record - and provably never will. For this task I will provide a more complex tool in a few weeks.

This article documents the structure of a single event record within a Vista Event Log (.evtx) file. The event records go one by one, following the chunk header.

Each event log file contains one or many so-called "chunks", which store the event records. During operation, only the current chunk of an event log file is mapped into memory.

This article documents the Evtx file header. The file header provides some overall information about a Vista event log file.

In this article I provide a spell of magic(5) which allows file(1) to identify Vista event log files in their native form (.evtx).

My paper Introducing the Microsoft Vista Event Log File Format has been accepted for presentation at DFRWS 2007. See you in Pittsburgh!

Microsoft pushed out Release Candidate 2 of Vista. Among the host of new features in Vista there is a new file format for event logs. This article is the first in a series which shall help you to accustom yourself to the new format.