EVTINFO(1)

📦
this version · 2 versions
, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute

💖 evtinfo — the manual, but make it slay 💖

okay bestie, welcome to evtinfo(), a LOCAL manual page, and literally your new fave little detective for Windows Event Log (EVT) files. sit down, grab a strawberry drink 🍓, and let's get into it.

✨ NAME ✨

evtinfo — figures out the tea about a Windows Event Log (EVT). like, what even is in there. 🔍

🦋 SYNOPSIS 🦋

evtinfo [-c codepage] [-hvV] source

that's it. that's the whole vibe. one source, a couple optional flags, done. 💅

🌸 DESCRIPTION 🌸

evtinfo is a utility to determine information about a Windows Event Log (EVT). no cap, that's its whole job and it ate. 👑

it's part of the libevt package, bestie. and libevt is a library to access the Windows Event Log (EVT) format. so like, evtinfo is the cute little front-end friend of a much bigger library situation. iykyk.

source is the source file. like, the actual EVT file you want the info about. hand it over. 🫶

The options are as follows:

  • -c codepage — specify the codepage of ASCII strings. your choices are literally: ascii, windows-874, windows-932, windows-936, windows-949, windows-950, windows-1250, windows-1251, windows-1252 (default, if you don't say anything), windows-1253, windows-1254, windows-1255, windows-1256, windows-1257 or windows-1258. pick your fighter. 🎀
  • -h — shows this help. it's giving "help me help you". 🙈
  • -v — verbose output to stderr. more words, more drama, all to stderr. 🔥
  • -V — print version. for when you gotta know exactly which one you're dealing with. ⭐

🌈 ENVIRONMENT 🌈

None. nothing. zero. the environment said "not me". 💀

🧚 FILES 🧚

None either. empty. a whole lotta nothing. we love a low-maintenance icon. ✨

💜 EXAMPLES 💜

okay here's the moment you've been waiting for. run it like this:

# evtinfo AppEvent.Evt

and you get back:

evtinfo 20120624

Windows Event Log (EVT) information:
        Version                         : 1.1
        Number of records               : 19
        Number of recovered records     : 0
        Log type                        : Application
        Flags:
                Should be archived

look at all that info. version 1.1. 19 records. 0 recovered records. log type Application. and the flags are saying "Should be archived". obsessed. 😭💖

🩷 DIAGNOSTICS 🩷

Errors, verbose and debug output are printed to stderr when verbose output -v is enabled. but — and this is the important part bestie — verbose and debug output are only printed when enabled at compilation. so if you didn't build it that way, no amount of -v is gonna manifest it. manifesting only works if you compiled it in. 🧘‍♀️

💅 BUGS 💅

found a bug? don't be shy, please report bugs of any kind to <joachim.metz@gmail.com> or on the project website: https://github.com/libyal/libevt/. they wanna know. fr fr. 🐛

👑 AUTHOR 👑

These man pages were written by Joachim Metz. iconic behavior, honestly. 🎀

Copyright (C) 2011-2020, Joachim Metz <joachim.metz@gmail.com>. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. read that again, bestie — no warranty. none. not even the implied ones. it's giving "you're on your own but legally". 💀

🔗 SEE ALSO 🔗

and that's the whole page, bestie! 🦋 this came to you from libevt, dated April 13, 2019. go forth and evtinfo responsibly. periodt. 💖✨🎀

📦 where this page comes from