/Eventlogedit-evtx--Evolution

Remove individual lines from Windows XML Event Log (EVTX) files

Primary LanguageC++

Eventlogedit-evtx--Evolution

Remove individual lines from Windows XML Event Log (EVTX) files

Support: Win7 and later

Compare with DanderSpritz,my way don't need dll injection and support more version(Server2012 and later).(It can be used to delete the setup.evtx,others need more test)

Need more test and suggestions.

The data structure and some code details are inspired by https://bbs.pediy.com/thread-219313.htm

My posts about the details:

  1. Windows XML Event Log (EVTX)单条日志清除（一）——删除思路与实例
  2. Windows XML Event Log (EVTX)单条日志清除（二）——程序实现删除evtx文件的单条日志记录
  3. Windows XML Event Log (EVTX)单条日志清除（三）——通过解除文件占用删除当前系统单条日志记录
  4. ...

Later I'll translate them into English.

Note:

  • WinXP and Win7,ObjectTypeNumber = 0x1c
  • Win8 and later,ObjectTypeNumber = 0x1e

DeleteRecordofFile.cpp

Read an evtx file(c:\test\Setup.evtx),then delete an event log(EventRecordID=14).

The new evtx file is saved as c:\test\SetupNew.evtx.

Delete the eventlog by rewriting the evtx file.

DeleteRecordofFileEx.cpp

Read an evtx file,then delete an event log.

The new file(temp.evtx) will be saved at the same path.

Delete the eventlog by using WinAPI EvtExportLog.

DeleteRecordbyTerminateProcess.cpp

Kill the eventlog service's process and delete one eventlog record,then restart the Eventlog Service.

Delete the eventlog by rewriting the evtx file.

DeleteRecordbyTerminateProcessEx.cpp

Kill the eventlog service's process and delete one eventlog record,then restart the Eventlog Service.

Delete the eventlog by using WinAPI EvtExportLog.

Note:

The EventRecordID of the events after the deleted one will not be changed.

DeleteRecordbyGetHandle.cpp

Get specified .evtx file's handle and delete one eventlog record.

It can be used to delete the setup.evtx,others need more test.

Delete the eventlog by rewriting the evtx file.

Setup.evtx

Number of events:15

SetupNew.evtx

Number of events:14

You can use DeleteRecordofFile.cpp to delete the second eventlog record(EventRecordID=14) of Setup.evtx.

SuspendorResumeTid.cpp

Suspend or resume the Eventlog Service's thread.

Use to stop or resume the system to collect logs.