DFIR blog: Windows Event Log forensics & .evtx parsing

Start here: a DFIR analyst's guide to .evtx

What .evtx is, which channels matter, the Event IDs to know, and where to find each one on disk. A navigational starting point for everything else on this blog.