/// <summary> /// /// </summary> /// <param name="path"></param> /// <returns></returns> public static EventRecord[] Get(string path) { List <EventRecord> recordList = new List <EventRecord>(); // Get Content of EventLog FileRecord fileRecord = FileRecord.Get(path, true); byte[] bytes = fileRecord.GetContent(); // Get EventLog Header EventLogHeader evtxHeader = new EventLogHeader(bytes); int chunkOffset = 0x1000; // Iterate through chunks for (int i = 0; i < evtxHeader.NumberOfChunks; i++) { // Get Chunk Header ChunkHeader chunkHeader = new ChunkHeader(bytes, chunkOffset); if (chunkHeader.LastEventRecordNumber == -1) { break; } int recordOffset = chunkOffset + 0x200; // Iterate through EventRecords for (long j = chunkHeader.FirstEventRecordNumber; j <= chunkHeader.LastEventRecordNumber; j++) { EventRecord eventRecord = new EventRecord(bytes, chunkOffset, recordOffset, path); recordList.Add(eventRecord); recordOffset += (int)eventRecord.Size; } // Increment Chunk Offset to point to next chunk chunkOffset += 0x10000; } return(recordList.ToArray()); }
public static EventRecord[] Get(string path) { List<EventRecord> recordList = new List<EventRecord>(); // Get Content of EventLog FileRecord fileRecord = FileRecord.Get(path, true); byte[] bytes = fileRecord.GetContent(); // Get EventLog Header EventLogHeader evtxHeader = new EventLogHeader(bytes); int chunkOffset = 0x1000; // Iterate through chunks for (int i = 0; i < evtxHeader.NumberOfChunks; i++) { // Get Chunk Header ChunkHeader chunkHeader = new ChunkHeader(bytes, chunkOffset); if(chunkHeader.LastEventRecordNumber == -1) { break; } int recordOffset = chunkOffset + 0x200; // Iterate through EventRecords for (long j = chunkHeader.FirstEventRecordNumber; j <= chunkHeader.LastEventRecordNumber; j++) { EventRecord eventRecord = new EventRecord(bytes, chunkOffset, recordOffset, path); recordList.Add(eventRecord); recordOffset += (int)eventRecord.Size; } // Increment Chunk Offset to point to next chunk chunkOffset += 0x10000; } return recordList.ToArray(); }