EVTEXPORT(1)

💖 NAME 💖

evtexport — exports items stored in a Windows Event Log (EVT) 💅

okay so real talk, this is the evtexport() page, manual section LOCAL (yes, that's the manual name, she's local, she's humble, she's iconic) 🎀

---

✨ SYNOPSIS ✨

evtexport [-c codepage] [-l log_file] [-m mode] [-p message_files_path]
          [-r registy_files_path] [-s system_file] [-S software_file]
          [-t event_log_type] [-hvV] source

---

🌸 DESCRIPTION 🌸

bestie. evtexport is a utility to export items stored in a Windows Event Log (EVT). that's it, that's the job, and she does it beautifully 🫶

evtexport is part of the libevt package. and libevt is a library to access the Windows Event Log (EVT) format. the whole little family, so cute 🌈

source is the source file. yeah that's the one argument, no cap.

The options are as follows — and no, we are not skipping a single one, every flag gets its moment 💅:

• -c codepage — specify the codepage of ASCII strings. options are: ascii, windows-874, windows-932, windows-936, windows-949, windows-950, windows-1250, windows-1251, windows-1252 (default, bestie, that's the one you get if you say nothing), windows-1253, windows-1254, windows-1255, windows-1256, windows-1257 or windows-1258.
• -h — shows this help. she's helpful. we love her.
• -l log_file — specify the file in which to log information about the exported items. receipts, but make them a file 📝
• -m mode — export mode. options: all, items (default), recovered. all exports the (allocated) items and recovered items, items exports the (allocated) items and recovered exports the recovered items. pick your fighter ✨
• -p message_files_path — search PATH for the resource files (default is the current working directory). lowkey she starts looking right where you're standing.
• -r registy_files_path — name of the directory containing the SOFTWARE and SYSTEM (Windows) Registry file. (yes, it's spelled registy in the flag, don't come for me, I don't make the rules 💀)
• -s system_file — filename of the SYSTEM (Windows) Registry file. This option overrides the path provided by -r. she said I'm the path now 👑
• -S software_file — filename of the SOFTWARE (Windows) Registry file. This option overrides the path provided by -r. same energy, different registry 🎀
• -t event_log_type — event log type. options: application, security, system. if not specified the event log type is determined based on the filename. she'll figure it out herself, she's smart like that 🧚
• -v — verbose output to stderr. tell me everything, I'm nosy 👀
• -V — print version. drop the number, bestie 🔥

---

🌈 ENVIRONMENT 🌈

None. nothing. empty. the environment said "no thoughts, head empty" 🙈

---

🦋 FILES 🦋

None. also nothing. she brings her own vibes ✨

---

💜 EXAMPLES 💜

here's the whole thing in action, watch and learn:

# evtexport evtexport -p c/ -r c/Windows/System32/config/ c/Windows/System32/config/AppEvent.Evt
evtexport 20120910

      ...

like. look at her go. main character energy fr fr 💅

---

🍓 DIAGNOSTICS 🍓

Errors, verbose and debug output are printed to stderr when verbose output -v is enabled. Verbose and debug output are only printed when enabled at compilation. so if you're getting nothing, it might literally not be compiled in — not a you problem, a build problem 😭

---

🎀 BUGS 🎀

Please report bugs of any kind to <joachim.metz@gmail.com> or on the project website: https://github.com/libyal/libevt/

found a bug? tell her. she wants to know. constructive criticism only though, we don't do mean here 🫶

---

👑 AUTHOR 👑

These man pages were written by Joachim Metz.

---

⭐ COPYRIGHT ⭐

Copyright (C) 2011-2020, Joachim Metz <joachim.metz@gmail.com>. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

so like, no warranty. NO warranty. not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. read it and weep, bestie 💀

---

💖 SEE ALSO 💖

• evtinfo(1)

---

okay and that's the whole page, thank you for coming to my ted talk 🎀 this was libevt, dated April 13, 2019, and it's the evtexport() page from section LOCAL — go export something cute, bestie, you got this 💅✨🦋