Regarding windows evt File

Using TestDisk to undelete files
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
pdam123
Posts: 3
Joined: 26 Apr 2012, 01:47

Regarding windows evt File

#1 Post by pdam123 »

I was trying to use photorec 6.13 (windows 7 64 bit and 32 Bit both ) and trying to recover event logs win7 event logs are evtx file soI used the wvutil tool to convert them into evt . Then I delete them and run Photorec but its does not show up .jpg and other formats work fine

My question is that is this supported as of now in PhotoRec . and Windows 7 . The strange aspect was when I tried to run fidentity it showed evt file as :unknown . Any idea what might be wrong . Or is there any flag /debug /log which I can turn on and find useful Info .

Thanks for your time

User avatar
Fiona
Posts: 2835
Joined: 18 Feb 2012, 17:19
Location: Ludwigsburg/Stuttgart - Germany

Re: Regarding windows evt File

#2 Post by Fiona »

Did you add your extension/file type using fidentify for your session?
http://www.cgsecurity.org/wiki/Add_your ... o_PhotoRec
If you recover files, in your first folder recup_dir.1 you'll find a report.xml-file which provides info.

Current versions don't create a log anymore.
If you want to run with /log /debug you can do the following;
Run your command prompt as an administrator.
Go to Start.
Write cmd in search programs and files.
Press both, the Ctrl-key and Shift and press enter.
Confirm to proceed your command prompt as administrator.
At the prompt, write;

Code: Select all

cd
and press space.
Copy the path to your TestDisk-folder.
Example;

Code: Select all

C:\Users\Fiona\Downloads\testdisk-6.14-WIP.win\testdisk-6.14-WIP
Write

Code: Select all

photorec_win.exe /log /debug
.

pdam123
Posts: 3
Joined: 26 Apr 2012, 01:47

Re: Regarding windows evt File

#3 Post by pdam123 »

Thanks Fionna ,
Thats very helpful tips . The problem was however different . Any I never guessed it could happen
MS has this tool called wvutil which can convert evtx to evt .But that conversion is bogus as it does not change the header info . Their tool LogParser is able to detect it becuase prob it does not care for this
info . Photorec never detects it as the Header is still EVTX and evtx support is not there

Code: Select all

pdam@pdam-lp ~
$ hexdump -C   /cygdrive/d/tp/data/original.evt   |  head
00000000  45 6c 66 46 69 6c 65 00  00 00 00 00 00 00 00 00  |.00Elf.........|
00000010  17 00 00 00 00 00 00 00  8e 08 00 00 00 00 00 00  |................|
This is evtx format only .

When I take a file from Windows XP it works

Code: Select all

$ hexdump -C   /cygdrive/d/tp/data/a.evt   |  head
00000000  45 6c 66 46 69 6c 65 00  00 00 00 00 00 00 00 00  |...LfLe.........|
00000010  17 00 00 00 00 00 00 00  8e 08 00 00 00 00 00 00  |................|
Verified Photorec source code

Code: Select all

static const unsigned char evt_header[8]= {0x30, 0x00, 0x00, 0x00, 'L', 'f', 'L', 'e'}
BTW .I am writing a parser for evtx . Hopefully should be able to add some contribution to the great Open source community Here are some changes I have to do file_evt.c
  • The EVTX Format Contains Additional Fields in Each Log Record
    Header signature changed
    Streaming binary XML so we need to trim out unnecessary Data
    The Microsoft Vista event log contains two new fields: The keyword field and the opcode field. These are in addition to the traditional fields first introduced in the legacy EVT file format

    User Information Is No Longer Present In The User Field of Security Logs
Thanks again !

pdam123
Posts: 3
Joined: 26 Apr 2012, 01:47

Re: Regarding windows evt File

#4 Post by pdam123 »

Hi All ,
IIRC if the format itself is chnaging as in the case of evtx would it work just by adding a custom signature .Also is there a streaming media type that it currently recovered by PhotoRec ? I was planning to base my solution on the basis of code existing already for binary stream type of format .
Thanks
Pratik

Locked