Problem: When Windows event logs are cleared or deleted,
Windows.EventLogs.Cleared can show that a log was cleared, but the
events themselves are lost because parse_evtx() only reads intact log
files. The old data usually stays on disk, in unallocated space, the
pagefile or memory, until it is overwritten.
Solution:
This PR adds a new carve_evtx() VQL plugin. It scans any file or device
for EVTX chunk signatures at any offset and parses each 64KB chunk on
its own.
- Rows have the same structure as parse_evtx(), plus ChunkOffset,
ChunkHeaderValid, ChunkDataValid, ChunkTruncated and ChunkCompressed.
- NTFS-compressed chunks (the Windows default for event logs) are
decompressed.
- Damaged chunks are flagged, not dropped.
- With output=, the recovered events are also written to a new .evtx
file that Event Viewer can open.
Example:
SELECT * FROM carve_evtx(filename='''\\.\C:''', accessor="raw_file")
WHERE System.Channel = "Application"
Known limitation
Old records in chunk slack are not recovered yet. This could be a
follow-up.
---------
Co-authored-by: Mike Cohen <[email protected]>
