EVTXEXPORT(1)

💖 evtxexport — the girlies' guide to pulling stuff out of Windows Event Viewer logs 💖

okay so bestie, this one lives in the LOCAL manual section, and it's genuinely such a slay little tool. buckle up 🎀

---

✨ NAME ✨

evtxexport — exports items stored in a Windows XML EventViewer Log (EVTX) file 🦋

---

🌸 SYNOPSIS 🌸

evtxexport [-c codepage] [-f format] [-l log_file] [-m mode]
           [-p message_files_path] [-r registy_files_path]
           [-s system_file] [-S software_file] [-t event_log_type]
           [-hTvV] source

---

👑 DESCRIPTION 👑

evtxexport is a utility to export items stored in a Windows XML EventViewer Log (EVTX) file. that's it, that's the whole job, and it eats every time 💅

evtxexport is part of the libevtx package. libevtx is a library to access the Windows XML EventViewer Log (EVTX) file.

source is the source file. like, the actual EVTX file you want to dig through ✨

The options are as follows:

• -c codepage — specify the codepage of ASCII strings. your options are: ascii, windows-874, windows-932, windows-936, windows-949, windows-950, windows-1250, windows-1251, windows-1252 (this one's the default), windows-1253, windows-1254, windows-1255, windows-1256, windows-1257 or windows-1258. so many choices, pick your fave 🫶
• -f format — output format. options: xml, text (and text is the default).
• -h — shows this help. the classic. we love a helpful legend 💜
• -l log_file — specify the file in which to log information about the exported items.
• -m mode — export mode. option: all, items (the default), recovered. okay so all exports the (allocated) items and recovered items, items exports just the (allocated) items, and recovered exports only the recovered items. three modes, three moods 🌈
• -p message_files_path — search PATH for the resource files (default is the current working directory).
• -r registy_files_path — name of the directory containing the SOFTWARE and SYSTEM (Windows) Registry file.
• -s system_file — filename of the SYSTEM (Windows) Registry file. This option overrides the path provided by -r.
• -S software_file — filename of the SOFTWARE (Windows) Registry file. This option overrides the path provided by -r too. team effort fr fr.
• -t event_log_type — event log type. options: application, security, system. if not specified the event log type is determined based on the filename. it just knows 😭
• -T — use event template definitions to parse the event record data. fancy ✨
• -v — verbose output to stderr.
• -V — print version.

heads up bestie: keep an eye on your lowercase -v vs your uppercase -V, and your lowercase -s vs your uppercase -S. case sensitivity is not playing games here 💀

---

🧚 ENVIRONMENT 🧚

None. nothing. zero. the void. 💀

---

🌷 FILES 🌷

None. also nothing. iconic minimalism 🙈

---

⭐ EXAMPLES ⭐

# evtxexport evtxexport -p c/ -r c/Windows/System32/config/ c/Windows/System32/winevt/Logs/Apllication.Evtx
evtxexport 20120910

      ...

---

🔥 DIAGNOSTICS 🔥

Errors, verbose and debug output are printed to stderr when verbose output -v is enabled. Verbose and debug output are only printed when enabled at compilation. so like, if you turned -v on and nothing's showing up, that's a build-time thing, not a you thing, bestie 🫶

---

😭 BUGS 😭

Please report bugs of any kind to <joachim.metz@gmail.com> or on the project website: https://github.com/libyal/libevtx/

(no cap, they actually want to hear about it 💖)

---

👑 AUTHOR 👑

These man pages were written by Joachim Metz.

---

💜 COPYRIGHT 💜

Copyright (C) 2011-2024, Joachim Metz <joachim.metz@gmail.com>. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

read that "NO warranty" part again, babes. it's fr fr in all caps for a reason ⚠️

---

🦋 SEE ALSO 🦋

• evtxinfo(1)

---

that's a wrap on the libevtx era of this page, dated April 14, 2019 — the LOCAL manual section says hi, and so do I. go export something gorgeous 💅✨🎀