libevt(3)

💖 libevt(3) — Library Functions Manual 💖

okay bestie, sit down, hydrate, because today we're learning libevt — it's a whole manual page, it's from the Library Functions Manual, and it is genuinely so good. let's go 🫶

---

✨ NAME ✨

libevt.h — Library to access the Windows Event Log (EVT) format. that's the whole vibe. windows event logs. we read them. slay 💅

---

🦋 SYNOPSIS 🦋

first things first, you gotta let the compiler know you want in:

#include <libevt.h>

🌸 Support functions

const char *
libevt_get_version(void);

int
libevt_get_access_flags_read(void);

int
libevt_get_codepage(int *codepage, libevt_error_t **error);

int
libevt_set_codepage(int codepage, libevt_error_t **error);

int
libevt_check_file_signature(const char *filename,
    libevt_error_t **error);

Available when compiled with wide character string support:

int
libevt_check_file_signature_wide(const wchar_t *filename,
    libevt_error_t **error);

Available when compiled with libbfio support:

int
libevt_check_file_signature_file_io_handle(libbfio_handle_t *file_io_handle,
    libevt_error_t **error);

🌈 Notify functions

void
libevt_notify_set_verbose(int verbose);

int
libevt_notify_set_stream(FILE *stream, libevt_error_t **error);

int
libevt_notify_stream_open(const char *filename, libevt_error_t **error);

int
libevt_notify_stream_close(libevt_error_t **error);

💜 Error functions

void
libevt_error_free(libevt_error_t **error);

int
libevt_error_fprint(libevt_error_t *error, FILE *stream);

int
libevt_error_sprint(libevt_error_t *error, char *string, size_t size);

int
libevt_error_backtrace_fprint(libevt_error_t *error, FILE *stream);

int
libevt_error_backtrace_sprint(libevt_error_t *error, char *string,
    size_t size);

🎀 File functions

int
libevt_file_initialize(libevt_file_t **file, libevt_error_t **error);

int
libevt_file_free(libevt_file_t **file, libevt_error_t **error);

int
libevt_file_signal_abort(libevt_file_t *file, libevt_error_t **error);

int
libevt_file_open(libevt_file_t *file, const char *filename,
    int access_flags, libevt_error_t **error);

int
libevt_file_close(libevt_file_t *file, libevt_error_t **error);

int
libevt_file_is_corrupted(libevt_file_t *file, libevt_error_t **error);

int
libevt_file_get_ascii_codepage(libevt_file_t *file, int *ascii_codepage,
    libevt_error_t **error);

int
libevt_file_set_ascii_codepage(libevt_file_t *file, int ascii_codepage,
    libevt_error_t **error);

int
libevt_file_get_format_version(libevt_file_t *file,
    uint32_t *major_format_version, uint32_t *minor_format_version,
    libevt_error_t **error);

int
libevt_file_get_flags(libevt_file_t *file, uint32_t *flags,
    libevt_error_t **error);

int
libevt_file_get_number_of_records(libevt_file_t *file,
    int *number_of_records, libevt_error_t **error);

int
libevt_file_get_record_by_index(libevt_file_t *file, int record_index,
    libevt_record_t **record, libevt_error_t **error);

int
libevt_file_get_number_of_recovered_records(libevt_file_t *file,
    int *number_of_records, libevt_error_t **error);

int
libevt_file_get_recovered_record_by_index(libevt_file_t *file,
    int record_index, libevt_record_t **record, libevt_error_t **error);

Available when compiled with wide character string support:

int
libevt_file_open_wide(libevt_file_t *file, const wchar_t *filename,
    int access_flags, libevt_error_t **error);

Available when compiled with libbfio support:

int
libevt_file_open_file_io_handle(libevt_file_t *file,
    libbfio_handle_t *file_io_handle, int access_flags,
    libevt_error_t **error);

💀 File functions - deprecated

bestie. this one is deprecated. it's still here, it still compiles, but it's giving legacy. use the newer one, okay? 🥺

int
libevt_file_get_recovered_record(libevt_file_t *file, int record_index,
    libevt_record_t **record, libevt_error_t **error);

🧚 Record functions

int
libevt_record_free(libevt_record_t **record, libevt_error_t **error);

int
libevt_record_get_offset(libevt_record_t *record, off64_t *offset,
    libevt_error_t **error);

int
libevt_record_get_identifier(libevt_record_t *record,
    uint32_t *identifier, libevt_error_t **error);

int
libevt_record_get_creation_time(libevt_record_t *record,
    uint32_t *posix_time, libevt_error_t **error);

int
libevt_record_get_written_time(libevt_record_t *record,
    uint32_t *posix_time, libevt_error_t **error);

int
libevt_record_get_event_identifier(libevt_record_t *record,
    uint32_t *event_identifier, libevt_error_t **error);

int
libevt_record_get_event_type(libevt_record_t *record,
    uint16_t *event_type, libevt_error_t **error);

int
libevt_record_get_event_category(libevt_record_t *record,
    uint16_t *event_category, libevt_error_t **error);

int
libevt_record_get_utf8_source_name_size(libevt_record_t *record,
    size_t *utf8_string_size, libevt_error_t **error);

int
libevt_record_get_utf8_source_name(libevt_record_t *record,
    uint8_t *utf8_string, size_t utf8_string_size,
    libevt_error_t **error);

int
libevt_record_get_utf16_source_name_size(libevt_record_t *record,
    size_t *utf16_string_size, libevt_error_t **error);

int
libevt_record_get_utf16_source_name(libevt_record_t *record,
    uint16_t *utf16_string, size_t utf16_string_size,
    libevt_error_t **error);

int
libevt_record_get_utf8_computer_name_size(libevt_record_t *record,
    size_t *utf8_string_size, libevt_error_t **error);

int
libevt_record_get_utf8_computer_name(libevt_record_t *record,
    uint8_t *utf8_string, size_t utf8_string_size,
    libevt_error_t **error);

int
libevt_record_get_utf16_computer_name_size(libevt_record_t *record,
    size_t *utf16_string_size, libevt_error_t **error);

int
libevt_record_get_utf16_computer_name(libevt_record_t *record,
    uint16_t *utf16_string, size_t utf16_string_size,
    libevt_error_t **error);

int
libevt_record_get_utf8_user_security_identifier_size(libevt_record_t *record,
    size_t *utf8_string_size, libevt_error_t **error);

int
libevt_record_get_utf8_user_security_identifier(libevt_record_t *record,
    uint8_t *utf8_string, size_t utf8_string_size,
    libevt_error_t **error);

int
libevt_record_get_utf16_user_security_identifier_size(libevt_record_t *record,
    size_t *utf16_string_size, libevt_error_t **error);

int
libevt_record_get_utf16_user_security_identifier(libevt_record_t *record,
    uint16_t *utf16_string, size_t utf16_string_size,
    libevt_error_t **error);

int
libevt_record_get_number_of_strings(libevt_record_t *record,
    int *number_of_strings, libevt_error_t **error);

int
libevt_record_get_utf8_string_size(libevt_record_t *record,
    int string_index, size_t *utf8_string_size, libevt_error_t **error);

int
libevt_record_get_utf8_string(libevt_record_t *record, int string_index,
    uint8_t *utf8_string, size_t utf8_string_size,
    libevt_error_t **error);

int
libevt_record_get_utf16_string_size(libevt_record_t *record,
    int string_index, size_t *utf16_string_size,
    libevt_error_t **error);

int
libevt_record_get_utf16_string(libevt_record_t *record,
    int string_index, uint16_t *utf16_string, size_t utf16_string_size,
    libevt_error_t **error);

int
libevt_record_get_data_size(libevt_record_t *record, size_t *data_size,
    libevt_error_t **error);

int
libevt_record_get_data(libevt_record_t *record, uint8_t *data,
    size_t data_size, libevt_error_t **error);

---

🌟 DESCRIPTION 🌟

so like, the actual meat and potatoes? it's this one:

• libevt_get_version() — this function is used to retrieve the library version. that's it. that's the function. iconic behavior honestly 👑

---

⭐ RETURN VALUES ⭐

okay so here's the tea: most of the functions return NULL or -1 on error — it depends on the return type, so like, don't come for them, they're doing their best.

for the actual return values? go read "libevt.h". it's all in there, bestie, i don't make the rules 🫠

---

🌸 ENVIRONMENT 🌸

None

literally nothing. no env vars. empty. she's low maintenance 💅

---

🎀 FILES 🎀

None

nope, nothing here either. clean girl aesthetic ✨

---

🦋 NOTES 🦋

okay so this is important, listen up:

libevt can be compiled with wide character support (wchar_t).

to compile libevt with wide character support, use:

./configure --enable-wide-character-type=yes

or define:

_UNICODE

or:

UNICODE

during compilation.

and if you're sitting there like "was this thing even built with wide character support??" — bestie, i got you:

• LIBEVT_WIDE_CHARACTER_TYPE — this one lives in libevt/features.h and it can be used to determine if libevt was compiled with wide character support. go check her 🕵️♀️

---

😭 BUGS 😭

found a bug? please report bugs of any kind on the project issue tracker:

https://github.com/libyal/libevt/issues

no cap, they want to hear about it. do it for the culture 🫶

---

👑 AUTHOR 👑

these man pages are generated from "libevt.h". that's the source of truth, periodt 💖

---

🌈 COPYRIGHT 🌈

Copyright (C) 2011-2020, Joachim Metz <joachim.metz@gmail.com>.

this is free software; see the source for copying conditions. there is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

bestie read that again. NO WARRANTY. not even the fitness one. it's giving "you're on your own but in a cute way" 💀

---

💜 SEE ALSO 💜

• the libevt.h include file

---

and that's the whole page, babe ✨ this was libevt, man page libevt(3), and it's dated April 22, 2019. go read your event logs, you ate that 🎀🦋💖