evtx_dump is the CLI shipped with the omerbenamram/evtx Rust crate. It reads a Windows .evtx file and prints each record as XML, JSON or JSON Lines, using multiple threads. It is MIT/Apache licensed and runs on Windows, macOS and Linux.

Is this site really the same parser as evtx_dump?

Yes. The parsing core is the evtx crate compiled to WebAssembly, so records are rebuilt the same way. The difference is the interface: a browser UI with filters and exports instead of a command line.

evtx_dump vs. python-evtx vs. EvtxECmd?

evtx_dump (Rust) is the fastest and outputs XML/JSON. python-evtx is convenient inside Python scripts but much slower. EvtxECmd (Eric Zimmerman) normalises events into CSV/JSON with maps per Event ID and is popular in Windows-centric DFIR workflows.

Can evtx_dump read corrupted or partial EVTX files?

It is tolerant of damaged chunks and skips records it cannot parse instead of aborting. For carving records out of unallocated space, see our guide on recovering deleted EVTX records.

evtx_dump online: parse EVTX without installing anything

evtx_dump is the command-line tool of omerbenamram/evtx, the fast Rust parser for Windows .evtx event logs. EVTX parser is that same parser compiled to WebAssembly, so you get evtx_dump's output in a browser tab — no Rust toolchain, no binary download, and the file is never uploaded.

Open evtx_dump in your browser ↗

evtx_dump usage

Install

Download a prebuilt binary for Windows, macOS or Linux from the project's GitHub releases, or build it with Cargo.

cargo install evtx

Dump to XML (default)

With no options, evtx_dump prints every record as XML, the same structure Event Viewer's XML view shows.

evtx_dump Security.evtx > security.xml

Dump to JSON or JSON Lines

-o json prints JSON records; -o jsonl prints one JSON object per line, which is what jq, Elastic and most bulk loaders want.

evtx_dump -o jsonl Security.evtx > security.jsonl

evtx_dump vs. this site

Use evtx_dump for scripting, very large collections and many hosts at once. Use the browser version for ad-hoc triage: you get filtering, an Event ID breakdown, a timeline, built-in detections and CSV, TXT, JSON or XML export without installing anything.

How to use evtx_dump in the browser

1
Open EVTX parserOpen the homepage. The WebAssembly build of the evtx crate loads in a Web Worker.
2
Drop your .evtx filesDrag one or several .evtx files onto the drop zone. They are parsed locally, record by record, just like evtx_dump would.
3
Inspect or exportFilter and inspect each event's rebuilt XML, then export to JSON, CSV, TXT or XML.

evtx_dump FAQ

What is evtx_dump?: evtx_dump is the CLI shipped with the omerbenamram/evtx Rust crate. It reads a Windows .evtx file and prints each record as XML, JSON or JSON Lines, using multiple threads. It is MIT/Apache licensed and runs on Windows, macOS and Linux.
Is this site really the same parser as evtx_dump?: Yes. The parsing core is the evtx crate compiled to WebAssembly, so records are rebuilt the same way. The difference is the interface: a browser UI with filters and exports instead of a command line.
evtx_dump vs. python-evtx vs. EvtxECmd?: evtx_dump (Rust) is the fastest and outputs XML/JSON. python-evtx is convenient inside Python scripts but much slower. EvtxECmd (Eric Zimmerman) normalises events into CSV/JSON with maps per Event ID and is popular in Windows-centric DFIR workflows.
Can evtx_dump read corrupted or partial EVTX files?: It is tolerant of damaged chunks and skips records it cannot parse instead of aborting. For carving records out of unallocated space, see our guide on recovering deleted EVTX records.