---
name: "evtxexport"
section: "1"
platform: "linux"
package: "libevtx-utils"
version: "20240504-1+b1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/evtxexport"
---

# evtxexport(1)

exports items stored in a Windows XML EventViewer Log (EVTX) file

## NAME

**evtxexport** – exports items stored in a Windows XML EventViewer Log (EVTX) file

## SYNOPSIS

**evtxexport** \[**-c** *codepage*\] \[**-f** *format*\] \[**-l** *log\_file*\] \[**-m** *mode*\] \[**-p** *message\_files\_path*\] \[**-r** *registy\_files\_path*\] \[**-s** *system\_file*\] \[**-S** *software\_file*\] \[**-t** *event\_log\_type*\] \[**-hTvV**\] *source*

## DESCRIPTION

**evtxexport** is a utility to export items stored in a Windows XML EventViewer Log (EVTX) file

**evtxexport** is part of the **libevtx** package. **libevtx** is a library to access the Windows XML EventViewer Log (EVTX) file

*source* is the source file.

The options are as follows:

- **-c** *codepage*

  specify the codepage of ASCII strings, options: ascii, windows-874, windows-932, windows-936, windows-949, windows-950, windows-1250, windows-1251, windows-1252 (default), windows-1253, windows-1254, windows-1255, windows-1256, windows-1257 or windows-1258

- **-f** *format*

  output format, options: xml, text (default)

- **-h**

  shows this help

- **-l** *log\_file*

  specify the file in which to log information about the exported items

- **-m** *mode*

  export mode, option: all, items (default), recovered 'all' exports the (allocated) items and recovered items, 'items' exports the (allocated) items and 'recovered' exports the recovered items

- **-p** *message\_files\_path*

  search PATH for the resource files (default is the current working directory)

- **-r** *registy\_files\_path*

  name of the directory containing the SOFTWARE and SYSTEM (Windows) Registry file

- **-s** *system\_file*

  filename of the SYSTEM (Windows) Registry file This option overrides the path provided by -r

- **-S** *software\_file*

  filename of the SOFTWARE (Windows) Registry file This option overrides the path provided by -r

- **-t** *event\_log\_type*

  event log type, options: application, security, system if not specified the event log type is determined based on the filename.

- **-T**

  use event template definitions to parse the event record data

- **-v**

  verbose output to stderr

- **-V**

  print version

## ENVIRONMENT

None

## FILES

None

## EXAMPLES

```
# evtxexport evtxexport -p c/ -r c/Windows/System32/config/ c/Windows/System32/winevt/Logs/Apllication.Evtx
evtxexport 20120910

...
```

## DIAGNOSTICS

Errors, verbose and debug output are printed to stderr when verbose output -v is enabled. Verbose and debug output are only printed when enabled at compilation.

## BUGS

Please report bugs of any kind to \<joachim.metz@gmail.com\> or on the project website: https://github.com/libyal/libevtx/

## AUTHOR

These man pages were written by Joachim Metz.

## COPYRIGHT

Copyright (C) 2011-2024, Joachim Metz \<joachim.metz@gmail.com\>. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

## SEE ALSO

[evtxinfo(1)](/evtxinfo/1.md)