NAME¶

evtexport — exports items stored in a Windows Event Log (EVT) file

SYNOPSIS¶

DESCRIPTION¶

evtexport is a utility to export items stored in a Windows Event Log (EVT) file

evtexport is part of the libevt package. libevt is a library to access the Windows Event Log (EVT) format

source is the source file.

The options are as follows:

-c codepage

codepage of ASCII strings, options: ascii, windows-874, windows-932, windows-936, windows-949, windows-950, windows-1250, windows-1251, windows-1252 (default), windows-1253, windows-1254, windows-1255, windows-1256, windows-1257 or windows-1258

-h

shows this help

-l log_file

logs information about the exported items

-L lcid

preferred language of the message strings (default is 0, which is the first language in the resource file)

-m mode

export mode, option: all, items (default), recovered 'all' exports the (allocated) items and recovered items, 'items' exports the (allocated) items and 'recovered' exports the recovered items

-p resource_files_path

search PATH for the resource files (default is the current working directory)

-r registy_files_path

name of the directory containing the SOFTWARE and SYSTEM (Windows) Registry file

-s system_file

filename of the SYSTEM (Windows) Registry file This option overrides the path provided by -r

-S software_file

filename of the SOFTWARE (Windows) Registry file This option overrides the path provided by -r

-t event_log_type

event log type, options: application, security, system if not specified the event log type is determined based on the filename.

-v

verbose output to stderr

-V

print version

ENVIRONMENT¶

None

FILES¶

None

EXAMPLES¶

# evtexport evtexport AppEvent.Evt
evtexport 20260625

Event number			: 898
Creation time			: Oct 09, 2011 11:53:41 UTC
Written time			: Oct 09, 2011 11:53:41 UTC
Event type			: Information event (4)
Computer name			: HOSTNAME
Source name			: Windows Search Service
Event category			: 1
Event identifier		: 0x400003eb (1073742827)
Number of strings		: 0

DIAGNOSTICS¶

Errors, verbose and debug output are printed to stderr when verbose output -v is enabled. Verbose and debug output are only printed when enabled at compilation.

SEE ALSO¶

evtinfo(1)

AUTHORS¶

Joachim Metz <joachim.metz@gmail.com>

BUGS¶

Please report bugs of any kind on the project issue tracker: https://github.com/libyal/libevt/issues

COPYRIGHT¶

Copyright (C) 2011-2026, Joachim Metz <joachim.metz@gmail.com>.

This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.