A pure-Python parser for Windows Event Log (.evtx) files, written from the format specification with no runtime dependencies.
EvtxReader parses the complete EVTX format: file and chunk headers with CRC32 validation, event record enumeration, and Microsoft's binary XML (BinXml) event payloads including templates, substitution arrays, and all documented value types. Every record can be rendered as the same XML that Windows Event Viewer shows, or as a JSON-serializable dict. Output is validated record-for-record against evtx-rs, the reference parser used across the DFIR ecosystem.
Supports EVTX format versions 3.1 (Windows Vista through early Windows 10) and 3.2 (Windows 10 2004+, Windows 11, Server 2022).
$ pip install .
Requires Python 3.9 or later. No third-party dependencies.
from EvtxReader import EvtxFile
with EvtxFile('System.evtx') as log:
print(log.header.version, log.header.number_of_chunks)
for record in log.records():
print(record.id, record.timestamp)
print(record.xml())
record = log.get_record(1234)
event = record.dict()
print(event['Event']['System']['Channel'])records() iterates lazily, one 64 KiB chunk in memory at a time.
record.xml() returns Event Viewer-style XML; record.dict() returns a nested dict with attributes under #attributes, ready for json.dumps.
Chunk-level access is available through log.chunks(), including chunk.verify_checksums() for forensic integrity checks.
$ evtxreader info System.evtx
File: System.evtx
Format version: 3.1
Chunks: 53
...
$ evtxreader dump System.evtx # XML records
$ evtxreader dump System.evtx --json # one JSON object per line
$ evtxreader dump System.evtx --record 1234 # a single record
src/EvtxReader/
evtx_file.py EvtxFile: file header, chunk iteration, record lookup
file_header.py file header parsing and CRC32 validation
chunk.py chunk header, checksums, record enumeration, caches
record.py event record header, FILETIME timestamps, xml()/dict()
binxml/
tokenizer.py BinXml token stream -> AST, template and name caches
values.py decoders for all value types (GUID, SID, FILETIME, ...)
render.py AST -> XML string / dict with substitution binding
Parsing is buffer-based: the 4 KiB file header and each 64 KiB chunk are read into memory and decoded with struct.
Template definitions and name strings are cached per chunk, matching how the format deduplicates them on disk.
$ python3 -m venv venv && . venv/bin/activate
$ pip install -e '.[test]'
$ pytest
The test suite includes golden-file tests: every record in the sample logs is compared against reference output generated by evtx-rs (tests/expected/).