Skip to content
Fix acquired .evt - Windows Event Log files (Forensics)
Python
Branch: master
Clone or download
Latest commit af06db3 Mar 29, 2016
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
LICENSE Initial commit Mar 22, 2016
README.md Update README.md Mar 29, 2016
evtkit.py 0.2 (beta) Mar 29, 2016

README.md

evtkit

Fix acquired .evt - Windows Event Log files (Forensics)

Requirements

  • Python 2 (not tested on 3)
  • no external dependencies

Usage

Fix in-place 2 files (Make sure you got a copy!):

evtkit.py AppEvent.Evt SysEvent.Evt

Find all *.evt files in evt_dir/, copy them to fixed_copy/ and repair them:

evtkit.py --copy_to_dir=fixed_copy evt_dir

Options

-h, --help                                 show this help message and exit
-c COPY_TO_DIR, --copy_to_dir COPY_TO_DIR
                                           Output directory for fixed .evt files.
-q, --quiet                                Turn off verbosity
You can’t perform that action at this time.