EVTX
Generated by scripts/gen-format-pages.py from docs/data/format-metadata/, FILE_FORMATS.csv and docs/formats-master.csv. Do not edit by hand: change the source, then run the script.
Windows EVTX Preview.
At a glance
| Purpose | A Windows XML event log (.evtx): a header and 64 KiB chunks of event records in binary XML. |
| Extensions | .evtx |
| Poka parser | poka-evtx |
| Viewer | poka-tree-viewer |
| Depth tier | Parser with a shared viewer (see Depth tiers) |
| Breadth tier | B4 Summary (see Breadth tiers) |
How much Poka reads
B4 Summary. The container and metadata are read and summarised (counts, properties, structure), but the main content is not rendered.
Confidence: medium (the reviewer read the code). Basis: Reviewed 2026-10-26: read parsers/poka-evtx/src/main.rs (381 lines) and plugin.json. No unit tests or tests/samples.rs; the corpus has Setup.evtx, read by no test. Covers .evtx. The tree reads the file header (version, chunk numbers, next record ID, flags, CRC), walks the chunk headers and scans the records for their IDs and written times. Judgement: B4: the log's structure is decoded and records are counted, but no event is decoded.
What Poka does not read
- Event data (binary XML: event ID, provider, level, message data) is not decoded
- Checksums are shown, not verified
- Only a sample of records is listed (judgement from the code)
- Classic .evt logs go to the .evt module
Libraries
Libraries Poka uses or has assessed for this format, with the status, licence and language the registry records.
- evtx (candidate; MIT OR Apache-2.0; Rust; https://github.com/omerbenamram/EVTX) — Windows Event Log, pure Rust
Sources
- parsers/poka-evtx/src/main.rs
- parsers/poka-evtx/plugin.json