EVTX Viewer

 
 

EVTX Viewer is an iPhone App that allows to open the binary MS Event Viewer files. Have you ever got a file with the EVTX extension on your iPhone, but had to run back to a Windows machine to view it? Well this happened to me too many times, so I have developed EVTX Viewer.

 
 

Also available is EVTX Reader, a Mac application, based on the same file parsing code.

 

Features:

View Event Log Files - This is the main feature of EVTX Viewer. The log file is scanned in a fast pass and all the events are displayed from the oldest to the newest.

Search and Filter - Above the list of events, there is a Search Bar with Filter Buttons. Using this bar will initiate the thorough pass, which will filter the events using a Case-Sensitive search.

View Event Detailes - Tap on event to view its details. Note that the full XML representation of the event is last.

 

Notes:

Launch EVTX Viewer - Starting the app will present a simple UI that instruct you to open EVTX files from other apps. This is an important simplification of the UI, since it means this app does not need to be a files manager.

Open EVTX File - The file extension EVTX is registered by EVTX Viewer, so any app that offers to "Open in ..." or "Import with ..." a file, will be able to view EVTX files.

Other Apps - The list of other apps that can benefit from EVTX Viewer is huge, just for example, Mail and Gmail can view EVTX attachments with EVTX Viewer. There are many cloud drive apps, such as iCloud Drive, Dropbox, etc., which can use EVTX Viewer to display log files.

 

Technical Stuff:

Empty Description - While many times the description is full of details, other times you may see empty description. This is due to the dependency of the Event Logging system on other DLLs. To simplify the first release, there is no such dependency on external DLLs in EVTX Viewer.

Unsupported Types - Some types are not yet supported, so the XML of an event may show <BinaryData>[unsupported type]</BinaryData> or similar text.

Programming Language - Users of this app are usually highly technical, so there is natural interest in the internal of this app. The app is written in Swift 3 and is using the libxml2 library.

 

You may contact me on Twitter using Direct Message. Thank You for using EVTX Viewer.