EvtxECmd

EvtxECmd.exe -d <evtx-dir> --csv <out>

Parse Windows EVTX files to CSV with EvtxECmd, converting logs into filterable data for analysis.

Run it when you have the EVTX files (collected with KAPE or copied from the system) and need to analyze them as data: EvtxECmd processes the .evtx files (Security, System, PowerShell, Sysmon...) and dumps them to CSV with the parsed events — each event with its channel, EventID, timestamp, and data fields. It's the step that turns binary logs into something filterable: the 4688 with its CommandLine, the 4624 with its LogonType, ready for Excel, Timeline Explorer, or filter-based analysis. In IR, it's the gateway to system logs.

Don't use it as analysis: EvtxECmd parses, the analysis (which event matters, what correlation) is the analyst's job — the unfiltered CSV output from a system with weeks of logs is huge. EVTX files in use are copied first (KAPE or manual copy with the service) — locked files give read errors. And watch out: parsing is faithful to the file — manipulated logs (altered EventIDs, deleted events) come out as-is; detecting manipulation (the 1102 cleanup, sequence gaps) is part of analysis, not the parser. For events from a specific channel, filtering by channel saves the full dump.