---
name: "libevtx"
section: "3"
platform: "linux"
package: "libevtx-dev"
version: "20240504-1+b1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/libevtx"
---

# libevtx(3)

Library to access the Windows XML Event Log (EVTX) format

## NAME

**libevtx.h** – Library to access the Windows XML Event Log (EVTX) format

## SYNOPSIS

**#include \<libevtx.h\>**

Support functions

*const* *char* *\**\

**libevtx\_get\_version**(*void*);

*int*\

**libevtx\_get\_access\_flags\_read**(*void*);

*int*\

**libevtx\_get\_codepage**(*int \*codepage*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_set\_codepage**(*int codepage*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_check\_file\_signature**(*const char \*filename*, *libevtx\_error\_t \*\*error*);

Available when compiled with wide character string support:

*int*\

**libevtx\_check\_file\_signature\_wide**(*const wchar\_t \*filename*, *libevtx\_error\_t \*\*error*);

Available when compiled with libbfio support:

*int*\

**libevtx\_check\_file\_signature\_file\_io\_handle**(*libbfio\_handle\_t \*bfio\_handle*, *libevtx\_error\_t \*\*error*);

Notify functions

*void*\

**libevtx\_notify\_set\_verbose**(*int verbose*);

*int*\

**libevtx\_notify\_set\_stream**(*FILE \*stream*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_notify\_stream\_open**(*const char \*filename*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_notify\_stream\_close**(*libevtx\_error\_t \*\*error*);

Error functions

*void*\

**libevtx\_error\_free**(*libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_error\_fprint**(*libevtx\_error\_t \*error*, *FILE \*stream*);

*int*\

**libevtx\_error\_sprint**(*libevtx\_error\_t \*error*, *char \*string*, *size\_t size*);

*int*\

**libevtx\_error\_backtrace\_fprint**(*libevtx\_error\_t \*error*, *FILE \*stream*);

*int*\

**libevtx\_error\_backtrace\_sprint**(*libevtx\_error\_t \*error*, *char \*string*, *size\_t size*);

File functions

*int*\

**libevtx\_file\_initialize**(*libevtx\_file\_t \*\*file*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_file\_free**(*libevtx\_file\_t \*\*file*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_file\_signal\_abort**(*libevtx\_file\_t \*file*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_file\_open**(*libevtx\_file\_t \*file*, *const char \*filename*, *int access\_flags*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_file\_close**(*libevtx\_file\_t \*file*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_file\_is\_corrupted**(*libevtx\_file\_t \*file*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_file\_get\_ascii\_codepage**(*libevtx\_file\_t \*file*, *int \*ascii\_codepage*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_file\_set\_ascii\_codepage**(*libevtx\_file\_t \*file*, *int ascii\_codepage*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_file\_get\_format\_version**(*libevtx\_file\_t \*file*, *uint16\_t \*major\_version*, *uint16\_t \*minor\_version*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_file\_get\_flags**(*libevtx\_file\_t \*file*, *uint32\_t \*flags*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_file\_get\_number\_of\_records**(*libevtx\_file\_t \*file*, *int \*number\_of\_records*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_file\_get\_record\_by\_index**(*libevtx\_file\_t \*file*, *int record\_index*, *libevtx\_record\_t \*\*record*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_file\_get\_number\_of\_recovered\_records**(*libevtx\_file\_t \*file*, *int \*number\_of\_records*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_file\_get\_recovered\_record\_by\_index**(*libevtx\_file\_t \*file*, *int record\_index*, *libevtx\_record\_t \*\*record*, *libevtx\_error\_t \*\*error*);

Available when compiled with wide character string support:

*int*\

**libevtx\_file\_open\_wide**(*libevtx\_file\_t \*file*, *const wchar\_t \*filename*, *int access\_flags*, *libevtx\_error\_t \*\*error*);

Available when compiled with libbfio support:

*int*\

**libevtx\_file\_open\_file\_io\_handle**(*libevtx\_file\_t \*file*, *libbfio\_handle\_t \*file\_io\_handle*, *int access\_flags*, *libevtx\_error\_t \*\*error*);

Record functions

*int*\

**libevtx\_record\_free**(*libevtx\_record\_t \*\*record*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_offset**(*libevtx\_record\_t \*record*, *off64\_t \*offset*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_identifier**(*libevtx\_record\_t \*record*, *uint64\_t \*identifier*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_creation\_time**(*libevtx\_record\_t \*record*, *uint64\_t \*filetime*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_written\_time**(*libevtx\_record\_t \*record*, *uint64\_t \*filetime*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_event\_identifier**(*libevtx\_record\_t \*record*, *uint32\_t \*event\_identifier*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_event\_identifier\_qualifiers**(*libevtx\_record\_t \*record*, *uint32\_t \*event\_identifier\_qualifiers*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_event\_version**(*libevtx\_record\_t \*record*, *uint8\_t \*event\_version*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_event\_level**(*libevtx\_record\_t \*record*, *uint8\_t \*event\_level*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_utf8\_provider\_identifier\_size**(*libevtx\_record\_t \*record*, *size\_t \*utf8\_string\_size*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_utf8\_provider\_identifier**(*libevtx\_record\_t \*record*, *uint8\_t \*utf8\_string*, *size\_t utf8\_string\_size*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_utf16\_provider\_identifier\_size**(*libevtx\_record\_t \*record*, *size\_t \*utf16\_string\_size*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_utf16\_provider\_identifier**(*libevtx\_record\_t \*record*, *uint16\_t \*utf16\_string*, *size\_t utf16\_string\_size*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_utf8\_source\_name\_size**(*libevtx\_record\_t \*record*, *size\_t \*utf8\_string\_size*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_utf8\_source\_name**(*libevtx\_record\_t \*record*, *uint8\_t \*utf8\_string*, *size\_t utf8\_string\_size*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_utf16\_source\_name\_size**(*libevtx\_record\_t \*record*, *size\_t \*utf16\_string\_size*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_utf16\_source\_name**(*libevtx\_record\_t \*record*, *uint16\_t \*utf16\_string*, *size\_t utf16\_string\_size*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_utf8\_channel\_name\_size**(*libevtx\_record\_t \*record*, *size\_t \*utf8\_string\_size*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_utf8\_channel\_name**(*libevtx\_record\_t \*record*, *uint8\_t \*utf8\_string*, *size\_t utf8\_string\_size*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_utf16\_channel\_name\_size**(*libevtx\_record\_t \*record*, *size\_t \*utf16\_string\_size*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_utf16\_channel\_name**(*libevtx\_record\_t \*record*, *uint16\_t \*utf16\_string*, *size\_t utf16\_string\_size*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_utf8\_computer\_name\_size**(*libevtx\_record\_t \*record*, *size\_t \*utf8\_string\_size*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_utf8\_computer\_name**(*libevtx\_record\_t \*record*, *uint8\_t \*utf8\_string*, *size\_t utf8\_string\_size*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_utf16\_computer\_name\_size**(*libevtx\_record\_t \*record*, *size\_t \*utf16\_string\_size*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_utf16\_computer\_name**(*libevtx\_record\_t \*record*, *uint16\_t \*utf16\_string*, *size\_t utf16\_string\_size*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_utf8\_user\_security\_identifier\_size**(*libevtx\_record\_t \*record*, *size\_t \*utf8\_string\_size*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_utf8\_user\_security\_identifier**(*libevtx\_record\_t \*record*, *uint8\_t \*utf8\_string*, *size\_t utf8\_string\_size*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_utf16\_user\_security\_identifier\_size**(*libevtx\_record\_t \*record*, *size\_t \*utf16\_string\_size*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_utf16\_user\_security\_identifier**(*libevtx\_record\_t \*record*, *uint16\_t \*utf16\_string*, *size\_t utf16\_string\_size*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_parse\_data\_with\_template\_definition**(*libevtx\_record\_t \*record*, *libevtx\_template\_definition\_t \*template\_definition*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_number\_of\_strings**(*libevtx\_record\_t \*record*, *int \*number\_of\_strings*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_utf8\_string\_size**(*libevtx\_record\_t \*record*, *int string\_index*, *size\_t \*utf8\_string\_size*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_utf8\_string**(*libevtx\_record\_t \*record*, *int string\_index*, *uint8\_t \*utf8\_string*, *size\_t utf8\_string\_size*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_utf16\_string\_size**(*libevtx\_record\_t \*record*, *int string\_index*, *size\_t \*utf16\_string\_size*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_utf16\_string**(*libevtx\_record\_t \*record*, *int string\_index*, *uint16\_t \*utf16\_string*, *size\_t utf16\_string\_size*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_data\_size**(*libevtx\_record\_t \*record*, *size\_t \*data\_size*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_data**(*libevtx\_record\_t \*record*, *uint8\_t \*data*, *size\_t data\_size*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_utf8\_xml\_string\_size**(*libevtx\_record\_t \*record*, *size\_t \*utf8\_string\_size*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_utf8\_xml\_string**(*libevtx\_record\_t \*record*, *uint8\_t \*utf8\_string*, *size\_t utf8\_string\_size*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_utf16\_xml\_string\_size**(*libevtx\_record\_t \*record*, *size\_t \*utf16\_string\_size*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_record\_get\_utf16\_xml\_string**(*libevtx\_record\_t \*record*, *uint16\_t \*utf16\_string*, *size\_t utf16\_string\_size*, *libevtx\_error\_t \*\*error*);

Template definition functions

*int*\

**libevtx\_template\_definition\_initialize**(*libevtx\_template\_definition\_t \*\*template\_definition*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_template\_definition\_free**(*libevtx\_template\_definition\_t \*\*template\_definition*, *libevtx\_error\_t \*\*error*);

*int*\

**libevtx\_template\_definition\_set\_data**(*libevtx\_template\_definition\_t \*template\_definition*, *const uint8\_t \*data*, *size\_t data\_size*, *uint32\_t data\_offset*, *libevtx\_error\_t \*\*error*);

## DESCRIPTION

The **libevtx\_get\_version**() function is used to retrieve the library version.

## RETURN VALUES

Most of the functions return NULL or -1 on error, dependent on the return type. For the actual return values see "libevtx.h".

## ENVIRONMENT

None

## FILES

None

## NOTES

libevtx can be compiled with wide character support (wchar\_t).

To compile libevtx with wide character support use: *./configure* *--enable-wide-character-type=yes*\
  or define: *\_UNICODE*\
  or *UNICODE*\
  during compilation.

*LIBEVTX\_WIDE\_CHARACTER\_TYPE*\
  in libevtx/features.h can be used to determine if libevtx was compiled with wide character support.

## BUGS

Please report bugs of any kind on the project issue tracker: https://github.com/libyal/libevtx/issues

## AUTHOR

These man pages are generated from "libevtx.h".

## COPYRIGHT

Copyright (C) 2011-2024, Joachim Metz \<joachim.metz@gmail.com\>.

This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

## SEE ALSO

the libevtx.h include file