evtinfo1

Usage

Overview

evtinfo is a utility to determine information about a Windows Event Log (EVT)

evtinfo is part of the libevt package. libevt is a library to access the Windows Event Log (EVT) format

source is the source file.

The options are as follows:

-c codepage

specify the codepage of ASCII strings, options: ascii, windows-874, windows-932, windows-936, windows-949, windows-950, windows-1250, windows-1251, windows-1252 (default), windows-1253, windows-1254, windows-1255, windows-1256, windows-1257 or windows-1258

-h

shows this help

-v

verbose output to stderr

-V

print version

Environment

None

Files

None

Examples

# evtinfo AppEvent.Evt
evtinfo 20120624
Windows Event Log (EVT) information:
	Version				: 1.1
	Number of records		: 19
	Number of recovered records	: 0
	Log type			: Application
	Flags:
		Should be archived

Diagnostics

Errors, verbose and debug output are printed to stderr when verbose output -v is enabled. Verbose and debug output are only printed when enabled at compilation.