.evtx · application/x-ms-evtx
What is a .evtx file?
Windows Event Log
About the format
An .evtx file is a Windows Event Log — the binary format behind everything you see in Event Viewer. The live logs (System, Application, Security and hundreds of service-specific channels) live in C:\Windows\System32\winevt\Logs, and exported or archived logs travel as .evtx too. The format (its header starts with the bytes 'ElfFile') stores events as templates plus data in a structure called binary XML, which is why a text editor shows gibberish. Each event carries a timestamp, a provider, an event ID and structured fields. For troubleshooting, the System log around the time of a crash or an unexpected reboot is the first place to look — Event ID 41 (Kernel-Power) marks a power loss or hard hang, 1001 (BugCheck) records the stop code of a blue screen, and disk/ntfs warnings foreshadow drive failures. On any Windows machine, Event Viewer opens these natively, including logs exported from another PC.
How to open a .evtx file
Windows
- Event Viewer (eventvwr.msc)
- wevtutil (command line)
- PowerShell Get-WinEvent
macOS
- evtx-dump (Rust tool)
Linux
- evtx-dump
- python-evtx
Is a .evtx file dangerous?
No — it's a log. Security logs can contain usernames and logon records, so treat exported logs from other people's machines with care.
Related file types
Not sure what a file is? Check its bytes.
File names lie; magic numbers don't. Drop any file into the identifier — nothing is uploaded.
Identify a file →