What is the EVTX file format?
.evtx is a system file used by Windows Event Viewer to store the Windows Event Log. The format replaced the older .evt binary logs when Microsoft introduced it with Windows Vista and Windows Server 2008. Both formats are still recognized on modern Windows systems. Event Viewer - and tools such as PowerShell's Get-WinEvent - can open .evtx files directly; they are also the native live logs written continuously by the operating system to %SystemRoot%\System32\winevt\Logs.
Windows logs all events pertaining to a given machine and the applications that run on it. Events are divided into several dedicated journal files, the four main ones being:
- Application journal - logs information related to running applications,
- Security journal - logs all events related to system security (for instance user login attempts),
- Setup journal - logs events related to system installations such as updates,
- System journal - contains various information about the Windows system.
All journals except the Security journal further group entries into three types:
- Information
- Warning
- Error
Each entry is assigned a unique Event ID, a timestamp, the name of the source that raised the event, and a short description. That description may not display properly if the source application is not installed on the machine where the log is being read. System administrators sometimes ask users to send an .evtx file for troubleshooting; it can be opened in Event Viewer or parsed with command-line tools such as EvtxECmd or Get-WinEvent.
Internally, .evtx stores records as binary XML (BinXML) packed into 64 KiB chunks, making it far more efficient and structured than its predecessor. Each chunk and the file header are protected by a CRC-32 checksum, enabling tamper and corruption detection. The .evtx format is widely used in Windows forensics and incident response.
Security & safety
RISK: LOWEVTX files are inert data logs - they do not execute and contain no macros, so opening one in Event Viewer or a parser is safe. The security angle is the opposite: EVTX files ARE the evidence. Attackers clear or tamper with logs (Security event ID 1102 records a log clear), so in incident response the concern is missing or altered logs, not malicious ones. One practical caution: EVTX records can contain attacker-controlled strings (command lines, paths), so when parsing untrusted logs use tools that don't execute embedded content and be wary of pasting raw fields into shells. Logs may also hold sensitive data (usernames, hostnames, IPs) - handle exported .evtx files accordingly.
Format details
in a nutshellPrograms that open EVTX files
Windows4 apps
Event Viewer
Built-in Run eventvwr.msc, then Action > Open Saved Log and select the .evtx. The native, full-fidelity viewer with the General/Details (XML) panes and filtering.
EvtxECmd (Eric Zimmerman)
Free Command-line parser for forensics: 'EvtxECmd.exe -f log.evtx --csv out' exports records to CSV/JSON for analysis in Timeline Explorer or Excel.
PowerShell (Get-WinEvent)
Built-in Get-WinEvent -Path log.evtx pipes events to filtering/export; e.g. add | Export-Csv out.csv. Scriptable, no extra install.
Chainsaw
Open-source Fast EVTX hunting with Sigma rules for threat detection: 'chainsaw hunt log.evtx -s sigma/'. For DFIR/blue-team use. 
macOS1 app
python-evtx
Open-source pip install python-evtx, then 'evtx_dump.py log.evtx' converts records to readable XML on macOS/Linux without Windows. 
Linux2 apps
evtx (Rust evtx_dump)
Open-source Fast cross-platform parser: 'evtx_dump log.evtx' outputs XML/JSON. Install via cargo or pip (the python 'evtx' binding).
python-evtx
Open-source 'evtx_dump.py log.evtx' renders events to XML on Linux. Widely used in DFIR pipelines. Technical details
deep spec| File signature | `ElfFile\0` (hex `45 6C 66 46 69 6C 65 00`) at byte offset 0 |
| Chunk signature | `ElfChnk\0` at the start of each 64 KiB data chunk; each event record begins with marker `2A 2A 00 00` |
| Internal encoding | Binary XML (BinXML) - events stored as binary-encoded XML using per-chunk template and string tables, avoiding the overhead of plain-text XML |
| Chunk size | 64 KiB (65,536 bytes) per chunk; file header occupies the first 4,096 bytes |
| Byte order | Little-endian throughout |
| MIME type | `application/octet-stream` |
| Integrity mechanism | CRC-32 checksums on the file header, each chunk header, and each event record - enables tamper and corruption detection |
| Default log location | `%SystemRoot%\System32\winevt\Logs\` - one `.evtx` file per log channel (e.g., `Application.evtx`, `Security.evtx`, `System.evtx`) |
| Predecessor format | `.evt` (Windows 2000/XP/2003 binary event log, replaced starting with Windows Vista) |
| Format version | Header carries major/minor version fields (commonly 3.1 or 3.2); format stable since Windows Vista |
| Default maximum log size | Configurable per channel; typical defaults range from 1 MB to 20 MB; logs wrap or archive when the limit is reached |
| Supported operating systems | Windows Vista, 7, 8, 10, 11 and Windows Server 2008 and later; also readable on Linux and macOS via open-source parsers |
| Compression | None - BinXML records are stored uncompressed; space savings come from binary encoding rather than compression |
| Per-chunk record tables | Each 64 KiB chunk contains its own string table and template table for self-contained decoding of the records within that chunk |
| Released | 2006-2007 (Windows Vista / Windows Server 2008, replacing the .evt format) |
| Latest version | EVTX (current in Windows 11 / Server 2025; format stable since Vista) |
| Specification | learn.microsoft.com |
EVTX conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about EVTX files.
