evtx

A simple System monitor(Sysmon) EVTX inspector; search, visualize, and track Sysmon events

The Forensic Examiner's Swiss Army Knife for analysing file-based forensic artifacts.

A Go library and CLI tool for parsing Windows Event Logs (EVTX) and carving EVTX chunks/records directly from raw images (disk dumps, memory dumps, page files)—useful when a complete, valid .evtx file is unavailable. From the PT ESC IR team.

A simplified EVTX file parser wrapping 0xrawsec's golang-evtx module

Lookup Windows event messages by their event id.

xr is an experimental fast event record analyzer.

Single-binary, local-first viewer for log, metric and trace files. Embedded DuckDB, no server, no index.