{"id":381,"date":"2019-03-04T20:31:39","date_gmt":"2019-03-04T20:31:39","guid":{"rendered":"http:\/\/eventlogxp.com\/blog\/?p=381"},"modified":"2020-05-17T21:45:38","modified_gmt":"2020-05-17T21:45:38","slug":"windows-event-viewer-cannot-read-classic-event-logs-anymore","status":"publish","type":"post","link":"https:\/\/eventlogxp.com\/blog\/windows-event-viewer-cannot-read-classic-event-logs-anymore\/","title":{"rendered":"Windows Event Viewer cannot read classic event logs anymore"},"content":{"rendered":"\n

Update of May 18, 2020<\/strong>: It looks like Windows 10 1909 doesn’t have this issue. <\/p>\n\n\n\n

Although era of Windows XP is over, there are still a great number of PCs running this operating system or Windows 2003 Server. According to different researches, in 2018 Windows XP market share was more than 4% of all desktop operating systems. Windows 2003 Server still has more than 10% of server operating systems. Moreover, Microsoft still supports Windows Embedded POSReady 2009 which is based on Windows XP. <\/p>\n\n\n\n

This means\nthat millions of computers across the globe still run XP-based OS and log their\nevents in classic (evt) event logs. <\/p>\n\n\n\n

When\nWindows Vista appeared in 2007, it introduced a new event log format along with\nnew Event Viewer. This Event Viewer went through Windows 7, 8, and got to\nWindows 10 practically unchanged. It was designed to open event log files in both\nformats \u2013 new (evtx) and legacy (evt). <\/p>\n\n\n\n

Unfortunately, Windows API doesn’t support evt files anymore and API function OpenBackupEventLog returns error 1500  (Log file is corrupted) when opening evt files. That’s why many third-party event viewers cannot read evt files on modern Windows. Event Viewer parses evt files and displays them like native evtx files. However, Windows 10 Event Viewer stopped working correctly.  First, we noticed that it doesn’t display event date and time for evt log files exported with Event Log Explorer (our application can export events to legacy format). Suggesting that this issue could be a bug of Event Log Explorer, we took several event log files from Windows XP \u2013 we saved several event logs as files using Windows XP Event Viewer and got a couple of “live” legacy event logs. In every case, Windows 10 Event Viewer failed to display event datetime for these log files.<\/p>\n\n\n\n

<\/p>\n\n\n\n

\"Windows<\/a><\/figure>\n\n\n\n

Since event\ntimestamp is a key field for any forensic examination, this makes impossible\nusing Windows Event Viewer as a forensic tool for legacy log analysis. <\/p>\n\n\n\n

Event Log\nExplorer doesn’t have this problem and displays event date and time correctly.<\/p>\n\n\n\n

<\/p>\n\n\n\n

\"Event<\/a><\/figure>\n\n\n\n

Want to read evt files? Download Event Log Explorer now!<\/a><\/p>\n\"Facebook\"<\/a>\"twitter\"<\/a>\"reddit\"<\/a>\"pinterest\"<\/a>\"linkedin\"<\/a>\"mail\"<\/a>","protected":false},"excerpt":{"rendered":"

Update of May 18, 2020: It looks like Windows 10 1909 doesn’t have this issue. Although era of Windows XP is over, there are still a great number of PCs running this operating system or Windows 2003 Server. According to different researches, in 2018 Windows XP market share was more than 4% of all desktop operating systems. Windows 2003 Server still has more than 10%\u2026 Read More »<\/a><\/span><\/p>\n","protected":false},"author":2,"featured_media":385,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[40],"tags":[68,65,66,67,49],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/posts\/381"}],"collection":[{"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/comments?post=381"}],"version-history":[{"count":4,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/posts\/381\/revisions"}],"predecessor-version":[{"id":447,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/posts\/381\/revisions\/447"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/media\/385"}],"wp:attachment":[{"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/media?parent=381"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/categories?post=381"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/eventlogxp.com\/blog\/wp-json\/wp\/v2\/tags?post=381"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}