igevtx

Windows EVTX file format parser: an experiment in Go

Sources:

go get github.com/2igosha/igevtx/dump_evtx

Usage:

dump_evtx list_of_evtx_filenames

The parser is wrapped in a package and can be used with a callback function:

import (
	"github.com/2igosha/igevtx/igevtx"
	...
	)
func printEvent(t time.Time, num uint64, variable map[string]string) {
	fmt.Fprintf(out, "Record #%d %04d-%02d-%02dT%02d:%02d:%02dZ ", num, t.Year(), t.Month(), t.Day(), t.Hour(), t.Minute(), t.Second())
	for n, v := range variable {
		fmt.Fprintf(out, "%s:%s,", n, normalizeNl(v))
	}
	fmt.Fprintf(out, "\n")
}
func main() {
	for _, fname := range os.Args[1:] {
		err := igevtx.ParseEvtx(fname, printEvent)
		if err != nil {
			fmt.Printf("parseEvtx(%s) : %v\n", fname, err)
			os.Exit(2)
		}
	}