mirror of
https://github.com/Velocidex/velociraptor.git
synced 2026-10-12 02:09:59 +00:00
Abdelghafour BouhdydandMike Cohen
fa9a5b4cd1
Problem: When Windows event logs are cleared or deleted, Windows.EventLogs.Cleared can show that a log was cleared, but the events themselves are lost because parse_evtx() only reads intact log files. The old data usually stays on disk, in unallocated space, the pagefile or memory, until it is overwritten. Solution: This PR adds a new carve_evtx() VQL plugin. It scans any file or device for EVTX chunk signatures at any offset and parses each 64KB chunk on its own. - Rows have the same structure as parse_evtx(), plus ChunkOffset, ChunkHeaderValid, ChunkDataValid, ChunkTruncated and ChunkCompressed. - NTFS-compressed chunks (the Windows default for event logs) are decompressed. - Damaged chunks are flagged, not dropped. - With output=, the recovered events are also written to a new .evtx file that Event Viewer can open. Example: SELECT * FROM carve_evtx(filename='''\\.\C:''', accessor="raw_file") WHERE System.Channel = "Application" Known limitation Old records in chunk slack are not recovered yet. This could be a follow-up. --------- Co-authored-by: Mike Cohen <[email protected]>