---
name: "libevt"
section: "3"
platform: "linux"
package: "libevt-dev"
version: "20200926-2"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/libevt"
---

# libevt(3)

Library to access the Windows Event Log (EVT) format

## NAME

**libevt.h** – Library to access the Windows Event Log (EVT) format

## SYNOPSIS

**#include \<libevt.h\>**

Support functions

*const* *char* *\**\

**libevt\_get\_version**(*void*);

*int*\

**libevt\_get\_access\_flags\_read**(*void*);

*int*\

**libevt\_get\_codepage**(*int \*codepage*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_set\_codepage**(*int codepage*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_check\_file\_signature**(*const char \*filename*, *libevt\_error\_t \*\*error*);

Available when compiled with wide character string support:

*int*\

**libevt\_check\_file\_signature\_wide**(*const wchar\_t \*filename*, *libevt\_error\_t \*\*error*);

Available when compiled with libbfio support:

*int*\

**libevt\_check\_file\_signature\_file\_io\_handle**(*libbfio\_handle\_t \*file\_io\_handle*, *libevt\_error\_t \*\*error*);

Notify functions

*void*\

**libevt\_notify\_set\_verbose**(*int verbose*);

*int*\

**libevt\_notify\_set\_stream**(*FILE \*stream*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_notify\_stream\_open**(*const char \*filename*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_notify\_stream\_close**(*libevt\_error\_t \*\*error*);

Error functions

*void*\

**libevt\_error\_free**(*libevt\_error\_t \*\*error*);

*int*\

**libevt\_error\_fprint**(*libevt\_error\_t \*error*, *FILE \*stream*);

*int*\

**libevt\_error\_sprint**(*libevt\_error\_t \*error*, *char \*string*, *size\_t size*);

*int*\

**libevt\_error\_backtrace\_fprint**(*libevt\_error\_t \*error*, *FILE \*stream*);

*int*\

**libevt\_error\_backtrace\_sprint**(*libevt\_error\_t \*error*, *char \*string*, *size\_t size*);

File functions

*int*\

**libevt\_file\_initialize**(*libevt\_file\_t \*\*file*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_file\_free**(*libevt\_file\_t \*\*file*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_file\_signal\_abort**(*libevt\_file\_t \*file*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_file\_open**(*libevt\_file\_t \*file*, *const char \*filename*, *int access\_flags*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_file\_close**(*libevt\_file\_t \*file*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_file\_is\_corrupted**(*libevt\_file\_t \*file*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_file\_get\_ascii\_codepage**(*libevt\_file\_t \*file*, *int \*ascii\_codepage*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_file\_set\_ascii\_codepage**(*libevt\_file\_t \*file*, *int ascii\_codepage*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_file\_get\_format\_version**(*libevt\_file\_t \*file*, *uint32\_t \*major\_format\_version*, *uint32\_t \*minor\_format\_version*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_file\_get\_flags**(*libevt\_file\_t \*file*, *uint32\_t \*flags*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_file\_get\_number\_of\_records**(*libevt\_file\_t \*file*, *int \*number\_of\_records*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_file\_get\_record\_by\_index**(*libevt\_file\_t \*file*, *int record\_index*, *libevt\_record\_t \*\*record*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_file\_get\_number\_of\_recovered\_records**(*libevt\_file\_t \*file*, *int \*number\_of\_records*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_file\_get\_recovered\_record\_by\_index**(*libevt\_file\_t \*file*, *int record\_index*, *libevt\_record\_t \*\*record*, *libevt\_error\_t \*\*error*);

Available when compiled with wide character string support:

*int*\

**libevt\_file\_open\_wide**(*libevt\_file\_t \*file*, *const wchar\_t \*filename*, *int access\_flags*, *libevt\_error\_t \*\*error*);

Available when compiled with libbfio support:

*int*\

**libevt\_file\_open\_file\_io\_handle**(*libevt\_file\_t \*file*, *libbfio\_handle\_t \*file\_io\_handle*, *int access\_flags*, *libevt\_error\_t \*\*error*);

File functions - deprecated

*int*\

**libevt\_file\_get\_recovered\_record**(*libevt\_file\_t \*file*, *int record\_index*, *libevt\_record\_t \*\*record*, *libevt\_error\_t \*\*error*);

Record functions

*int*\

**libevt\_record\_free**(*libevt\_record\_t \*\*record*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_record\_get\_offset**(*libevt\_record\_t \*record*, *off64\_t \*offset*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_record\_get\_identifier**(*libevt\_record\_t \*record*, *uint32\_t \*identifier*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_record\_get\_creation\_time**(*libevt\_record\_t \*record*, *uint32\_t \*posix\_time*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_record\_get\_written\_time**(*libevt\_record\_t \*record*, *uint32\_t \*posix\_time*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_record\_get\_event\_identifier**(*libevt\_record\_t \*record*, *uint32\_t \*event\_identifier*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_record\_get\_event\_type**(*libevt\_record\_t \*record*, *uint16\_t \*event\_type*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_record\_get\_event\_category**(*libevt\_record\_t \*record*, *uint16\_t \*event\_category*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_record\_get\_utf8\_source\_name\_size**(*libevt\_record\_t \*record*, *size\_t \*utf8\_string\_size*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_record\_get\_utf8\_source\_name**(*libevt\_record\_t \*record*, *uint8\_t \*utf8\_string*, *size\_t utf8\_string\_size*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_record\_get\_utf16\_source\_name\_size**(*libevt\_record\_t \*record*, *size\_t \*utf16\_string\_size*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_record\_get\_utf16\_source\_name**(*libevt\_record\_t \*record*, *uint16\_t \*utf16\_string*, *size\_t utf16\_string\_size*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_record\_get\_utf8\_computer\_name\_size**(*libevt\_record\_t \*record*, *size\_t \*utf8\_string\_size*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_record\_get\_utf8\_computer\_name**(*libevt\_record\_t \*record*, *uint8\_t \*utf8\_string*, *size\_t utf8\_string\_size*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_record\_get\_utf16\_computer\_name\_size**(*libevt\_record\_t \*record*, *size\_t \*utf16\_string\_size*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_record\_get\_utf16\_computer\_name**(*libevt\_record\_t \*record*, *uint16\_t \*utf16\_string*, *size\_t utf16\_string\_size*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_record\_get\_utf8\_user\_security\_identifier\_size**(*libevt\_record\_t \*record*, *size\_t \*utf8\_string\_size*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_record\_get\_utf8\_user\_security\_identifier**(*libevt\_record\_t \*record*, *uint8\_t \*utf8\_string*, *size\_t utf8\_string\_size*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_record\_get\_utf16\_user\_security\_identifier\_size**(*libevt\_record\_t \*record*, *size\_t \*utf16\_string\_size*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_record\_get\_utf16\_user\_security\_identifier**(*libevt\_record\_t \*record*, *uint16\_t \*utf16\_string*, *size\_t utf16\_string\_size*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_record\_get\_number\_of\_strings**(*libevt\_record\_t \*record*, *int \*number\_of\_strings*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_record\_get\_utf8\_string\_size**(*libevt\_record\_t \*record*, *int string\_index*, *size\_t \*utf8\_string\_size*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_record\_get\_utf8\_string**(*libevt\_record\_t \*record*, *int string\_index*, *uint8\_t \*utf8\_string*, *size\_t utf8\_string\_size*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_record\_get\_utf16\_string\_size**(*libevt\_record\_t \*record*, *int string\_index*, *size\_t \*utf16\_string\_size*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_record\_get\_utf16\_string**(*libevt\_record\_t \*record*, *int string\_index*, *uint16\_t \*utf16\_string*, *size\_t utf16\_string\_size*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_record\_get\_data\_size**(*libevt\_record\_t \*record*, *size\_t \*data\_size*, *libevt\_error\_t \*\*error*);

*int*\

**libevt\_record\_get\_data**(*libevt\_record\_t \*record*, *uint8\_t \*data*, *size\_t data\_size*, *libevt\_error\_t \*\*error*);

## DESCRIPTION

The **libevt\_get\_version**() function is used to retrieve the library version.

## RETURN VALUES

Most of the functions return NULL or -1 on error, dependent on the return type. For the actual return values see "libevt.h".

## ENVIRONMENT

None

## FILES

None

## NOTES

libevt can be compiled with wide character support (wchar\_t).

To compile libevt with wide character support use: *./configure* *--enable-wide-character-type=yes*\
  or define: *\_UNICODE*\
  or *UNICODE*\
  during compilation.

*LIBEVT\_WIDE\_CHARACTER\_TYPE*\
  in libevt/features.h can be used to determine if libevt was compiled with wide character support.

## BUGS

Please report bugs of any kind on the project issue tracker: https://github.com/libyal/libevt/issues

## AUTHOR

These man pages are generated from "libevt.h".

## COPYRIGHT

Copyright (C) 2011-2020, Joachim Metz \<joachim.metz@gmail.com\>.

This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

## SEE ALSO

the libevt.h include file