BinXML

EVTX Record Recovery: Advanced Carving Techniques for Damaged Windows Event Logs

Positive Technologies researchers detail methods for carving EVTX records directly from raw disk images, memory dumps, and virtual machine snapshots when standard file system access fails. The approach bypasses corrupted MFT structures or wiped partitions by scanning for ElfChnk and record signatures. Their Go-based library parses both intact and damaged EVTX files, recovering events even when checksums mismatch. The article explains the three-layer EVTX structure including file headers, 64 KB chunks, and BinXML records with template substitution for space efficiency. Two carving strategies are presented: chunk-level recovery that restores full field names via per-chunk caches, and record-level extraction that pulls values without templates. The work supports faster incident reconstruction in ransomware cases where attackers encrypt entire VDI or VHDX images.