What is the EVT file format?
.evt is the legacy Windows Event Log format introduced with Windows NT 3.1 in 1993 and used through Windows XP and Windows Server 2003. Three built-in log channels - System, Application, and Security - stored records in .evt files kept under %SystemRoot%\System32\config\.
Every file begins with a 48-byte header identified by the four-byte signature LfLe (hex 4C 66 4C 65). Each variable-length EVENTLOGRECORD entry opens with the same bytes in little-endian form (0x654C664C) and closes with a repeated copy of the record's own total length, allowing bidirectional traversal. Text strings within records are encoded as UTF-16 LE. Unused buffer space is padded with the sentinel value 0x00000027.
The log operates as a circular buffer: when the configurable maximum size is reached (default 512 KB), the file either overwrites the oldest entries or stops recording, depending on administrator policy.
Microsoft replaced .evt with .evtx - the XML-based Windows Event Log - starting with Windows Vista and Server 2008 in 2007. Modern Windows Event Viewer can open .evt files in compatibility mode. The full binary layout is documented in Microsoft's [MS-EVEN] protocol specification on Microsoft Learn.
Security & safety
RISK: LOWEVT files contain log data, not executable content. However, event strings can contain attacker-controlled data (e.g., injected via log poisoning); analysts should treat content strings as untrusted input when parsing. In forensics, log tampering (clearing or truncating EVT files) is itself an indicator of compromise - check the Security log for Event ID 517/1102 (audit log cleared).
Format details
in a nutshellPrograms that open EVT files
Windows4 apps
Windows Event Viewer
Built-in Open eventvwr.msc, then Action > Open Saved Log, navigate to the .evt file.
Microsoft Log Parser 2.2
Free Use command: LogParser.exe "SELECT * FROM file.evt" -i:EVT -o:CSV > output.csv
EVTXECmd (Eric Zimmermann Tools)
Free EVTXECmd.exe -f file.evt --csv output\ - exports to CSV/JSON for analysis. 
Linux1 app
Technical details
deep spec| File type | Binary structured event log (legacy Windows) |
| Developer | Microsoft Corporation |
| Encoding | Binary, little-endian |
| String encoding | UTF-16 LE (event message strings) |
| File header signature | LfLe (hex 4C 66 4C 65) at offset 0; header is 48 bytes |
| Record signature | 0x654C664C (eLfL) at start of each EVENTLOGRECORD |
| Record structure | Variable-length EVENTLOGRECORD; total length repeated at end for bidirectional traversal |
| Buffer model | Circular - overwrites oldest entries or stops when maximum size is reached (policy-configurable) |
| Default maximum file size | 512 KB (administrator-configurable) |
| Unused space padding | 0x00000027 sentinel value |
| Log channels | System, Application, Security (three built-in logs) |
| Supported OS | Windows NT 3.1 through Windows XP and Windows Server 2003 |
| Superseded by | .evtx (Windows XML Event Log), introduced in Windows Vista / Server 2008 (2007) |
| Format documentation | [MS-EVEN] protocol specification (Microsoft Learn) |
| Modern compatibility | Windows Event Viewer opens .evt files in compatibility mode on Vista and later |
| Released | 1993 (Windows NT 3.1) |
| Latest version | N/A - deprecated; replaced by EVTX in Windows Vista (2007) |
| Specification | learn.microsoft.com |
EVT conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about EVT files.
