DFIR blog: Windows Event Log forensics & .evtx parsing

Four ways to pull .evtx off a live Windows host — wevtutil, FTK Imager, KAPE, raw NTFS — with chain-of-custody trade-offs for each and the commands you'll actually run.

4625 is the failed-logon record. Read it right and you spot password sprays, credential stuffing, and Kerberos abuse before they succeed.

1102 is the one event you can't suppress without leaving more evidence. Here's what it tells you and what survives the clear.

How a .evtx file is laid out at the byte level — file header, 64 KB chunks, the template table, and the BinXML record stream that references it.

Scriptblock logging is Windows' most useful free defensive control. It records the full script body — including obfuscated or in-memory ones — under event 4104.

Service creation is one of the loudest persistence techniques. Event 7045 captures every install — read these three fields and you'll catch most of it.

Sysmon's event 1 is the richest process-creation record Windows can produce. Here's what's in it and how to triage it fast.

What a 4624 record actually contains, why the LogonType field matters more than the event itself, and how to read them at scale.

What .evtx is, which channels matter, the Event IDs to know, and where to find each one on disk — a navigational starting point for everything else on this blog.