Recovering Deleted MS Windows EVTX Event-Logs
Back in 2012 I wrote an EnScript to recover deleted MS Windows EVTX event-logs. I’d forgotten about it till today, when it occurred to me that the script wasn’t available through EnCase App Central.
The script is fairly straightforward to run. You’ll most often use it to search unallocated clusters -
EVTX files are quite complicated, particularly as they contain data in a format called BinXml, which is a compressed, tokenized version of XML.
EVTX log-files consist of a header plus one or more chunks. It is these chunks that contain the event-log records.
Unfortunately most of the records within a chunk are not self-contained - they incorporate parts of preceding records from the same chunk. This means that it’s not practicable to search for deleted records on an individual basis.
That said, the EVTX Log Entry Finder EnScript works by looking for deleted chunks, as can be seen when viewing the bookmarks created by the script, as shown by the following screenshot -
This screenshot shows the ‘ElfChnk’ signature at the start of a deleted chunk. Having located a chunk, the script prepends a synthezied EVTX event-log header and then hands it over to EnCase’s internal EVTX parsing engine, which will try and parse it.
If all things go well, the script will bookmark the resultant data both as an XML bookmark and in EnCase’s event-log record format. The following screenshot demonstrates how useful this can be when searching for deleted event-log records relating to the insertion and removal of external USB flash-memory disks -
The logs shown in the above screenshot originate from the Microsoft-Windows-DriverFrameworks-UserMode%4Operational.evtx event-log file. Many of the logs contain the device path and serial number of the USB device that’s been connected.
It would be nice to export the recovered logs as a sequence of one or more EVTX log-files that Windows can parse. Unfortunately this is not a trivial thing to do because of the error protection mechanisms that are present in EVTX file/chunk headers. That said, comparing the data bookmarked by the script to that visible in the MS Windows event-viewer application will usually help the examiner to understand exactly what they’re seeing -
The script will be available on EnCase App Central soon. If you’re a registered GSI Support Portal user you can download it from the following URL -
https://support.guidancesoftware.com/forum/downloads.php?do=file&id=1245
If you’d like more information about the structure of EVTX log-files check-out Joachim Metz’s libevtx project.
