Regarding windows evt File

[pdam123]

I was trying to use photorec 6.13 (windows 7 64 bit and 32 Bit both ) and trying to recover event logs win7 event logs are evtx file soI used the wvutil tool to convert them into evt . Then I delete them and run Photorec but its does not show up .jpg and other formats work fine

My question is that is this supported as of now in PhotoRec . and Windows 7 . The strange aspect was when I tried to run fidentity it showed evt file as :unknown . Any idea what might be wrong . Or is there any flag /debug /log which I can turn on and find useful Info .

Thanks for your time

[Fiona]

Did you add your extension/file type using fidentify for your session?
http://www.cgsecurity.org/wiki/Add_your ... o_PhotoRec
If you recover files, in your first folder recup_dir.1 you'll find a report.xml-file which provides info.

Current versions don't create a log anymore.
If you want to run with /log /debug you can do the following;
Run your command prompt as an administrator.
Go to Start.
Write cmd in search programs and files.
Press both, the Ctrl-key and Shift and press enter.
Confirm to proceed your command prompt as administrator.
At the prompt, write;

Code: Select all

cd

and press space.
Copy the path to your TestDisk-folder.
Example;

Code: Select all

C:\Users\Fiona\Downloads\testdisk-6.14-WIP.win\testdisk-6.14-WIP

Write

Code: Select all

photorec_win.exe /log /debug

.

[pdam123]

Thanks Fionna ,
Thats very helpful tips . The problem was however different . Any I never guessed it could happen
MS has this tool called wvutil which can convert evtx to evt .But that conversion is bogus as it does not change the header info . Their tool LogParser is able to detect it becuase prob it does not care for this
info . Photorec never detects it as the Header is still EVTX and evtx support is not there

Code: Select all

pdam@pdam-lp ~
$ hexdump -C   /cygdrive/d/tp/data/original.evt   |  head
00000000  45 6c 66 46 69 6c 65 00  00 00 00 00 00 00 00 00  |.00Elf.........|
00000010  17 00 00 00 00 00 00 00  8e 08 00 00 00 00 00 00  |................|

This is evtx format only .

When I take a file from Windows XP it works

Code: Select all

$ hexdump -C   /cygdrive/d/tp/data/a.evt   |  head
00000000  45 6c 66 46 69 6c 65 00  00 00 00 00 00 00 00 00  |...LfLe.........|
00000010  17 00 00 00 00 00 00 00  8e 08 00 00 00 00 00 00  |................|

Verified Photorec source code

Code: Select all

static const unsigned char evt_header[8]= {0x30, 0x00, 0x00, 0x00, 'L', 'f', 'L', 'e'}

BTW .I am writing a parser for evtx . Hopefully should be able to add some contribution to the great Open source community Here are some changes I have to do file_evt.c

• The EVTX Format Contains Additional Fields in Each Log Record
  Header signature changed
  Streaming binary XML so we need to trim out unnecessary Data
  The Microsoft Vista event log contains two new fields: The keyword field and the opcode field. These are in addition to the traditional fields first introduced in the legacy EVT file format
  
  User Information Is No Longer Present In The User Field of Security Logs

Thanks again !

[pdam123]

Hi All ,
IIRC if the format itself is chnaging as in the case of evtx would it work just by adding a custom signature .Also is there a streaming media type that it currently recovered by PhotoRec ? I was planning to base my solution on the basis of code existing already for binary stream type of format .
Thanks
Pratik