dtfabric.yaml

name: evtx
type: format
description: Windows XML Event Log (EVTX) format
urls: ["https://github.com/libyal/libevtx/blob/main/documentation/Windows%20XML%20Event%20Log%20(EVTX).asciidoc"
metadata:
  authors: ['Joachim Metz <joachim.metz@gmail.com>']
  year: 2011
attributes:
  byte_order: little-endian
layout:
- data_type: file_header
  offset: 0
---
name: byte
type: integer
attributes:
  format: unsigned
  size: 1
  units: bytes
---
name: uint32
type: integer
attributes:
  format: unsigned
  size: 4
  units: bytes
---
name: uint64
type: integer
attributes:
  format: unsigned
  size: 8
  units: bytes
---
name: file_header
type: structure
description: File header
members:
- name: signature
  type: stream
  element_data_type: byte
  elements_data_size: 8
  value: "ElfFile\x00"
- name: first_chunk_number
  data_type: uint64
- name: last_chunk_number
  data_type: uint64
- name: next_record_identifier
  data_type: uint64
- name: header_size
  data_type: uint32
- name: minor_format_version
  data_type: uint16
- name: major_format_version
  data_type: uint16
- name: header_block_size
  data_type: uint16
- name: number_of_chunks
  data_type: uint16
- name: unknown1
  type: stream
  element_data_type: byte
  elements_data_size: 76
- name: file_flags
  data_type: uint32
- name: checksum
  data_type: uint32