EVTX Record Recovery: Advanced Carving Techniques for Damaged Windows Event Logs
Positive Technologies researchers have published a detailed technical guide on recovering EVTX records through carving techniques when attackers destroy or encrypt Windows event logs.
Windows event logs in EVTX format remain a critical telemetry source during incident response. They frequently provide the only evidence of credential theft, lateral movement, or persistence. Attackers routinely clear logs with wevtutil cl, encrypt them, or wipe entire disks. Modern ransomware increasingly targets full virtual machine images such as VDI, VMDK, and VHDX, rendering the volume file system unmountable due to destroyed MFT or partition tables.
EVTX File Structure
An EVTX file consists of three nested layers: file header, chunks, and records. The 4096-byte file header begins with the magic ElfFile\x00 and contains fields for first and last chunk numbers, next record ID, and two CRC32 checksums. Each 65536-byte chunk starts with ElfChnk\x00 and holds its own header with separate checksums for the header and event data, plus caches for strings and templates.
Event records begin with the magic bytes 2A 2A 00 00, followed by DataSize, EventRecordID, a FILETIME timestamp, BinXML body, and a duplicate DataSize trailer. The trailer enables boundary detection during carving. BinXML uses token streams and template instances to avoid repeating tag names, storing full templates once per chunk and referencing them via TemplateInstance tokens.
Carving Methods
The team describes two carving approaches. Chunk-based carving searches for the ElfChnk\x00 signature at any offset, validates header and data checksums separately, and assigns high, medium, or low confidence levels. When checksums match, full records with named fields are reconstructed using the chunk’s string and template caches.
Record-based carving scans for the 2A 2A 00 00 magic and extracts substitution values directly from TemplateInstance records. This method recovers field values even when the owning chunk and its caches are lost, although field names cannot be restored. The EventRecordID sequence helps identify gaps caused by deleted events.
The resulting library, implemented in Go, handles both complete files and raw images while tolerating checksum mismatches. It supports automated pipelines for large-scale artifact analysis during ransomware and targeted intrusion investigations.
Related articles
Hacker or Engineer? Reconstructing Attack Chains in Industrial OT Networks
Positive Technologies expert Anton Kutepov presents a detailed educational scenario from the Standoff online polygon to demonstrate how security teams can trace an attack from initial perimeter compromise to unauthorized writes on a PLC. The case begins with an unexpected SCADA server command to a hydrocracking unit controller outside the maintenance window. By correlating network traffic, endpoint telemetry, authentication logs, and asset context, analysts reconstruct the full path: exploitation of a vulnerable DMZ system, lateral movement via Kerberoasting and Active Directory certificate abuse, RDP access to an engineering workstation, and finally weakening of Windows Defender on the SCADA server before issuing the control command. The analysis shows that a single permitted industrial protocol operation becomes suspicious only when placed in the context of prior defensive control changes and anomalous access routes. The article stresses that protecting OT environments requires continuous asset inventory, unified telemetry from traffic and endpoints, and pre-approved response playbooks that avoid disrupting the physical process.
Russia Sets 2030 Deadline to Deliver LTE Internet to Small Settlements
The Russian Ministry of Digital Development has outlined a timeline to provide mobile LTE internet access to small settlements with populations between 100 and 1,000 people by the end of 2030. Minister Maksut Shadaev stated in the State Duma that the next major milestone involves connecting an additional 1,800 settlements by 2027. Over the past six years, LTE service has already reached more than 8,000 such localities through the ongoing federal program. The initiative focuses on building the necessary mobile infrastructure rather than guaranteeing signal coverage at every geographic point. Residents in these areas are expected to gain reliable access to standard digital services without needing to search for optimal signal locations. Progress will be measured by actual deployed infrastructure and operational connectivity at the 2027 checkpoint.
Russian Woman Fined 15,000 Rubles for ChatGPT-Generated Bear Image That Sparked Police Hunt
A resident of Magdagachi in Russia's Amur region used ChatGPT to add a bear to a photo of Krasnoarmeyskaya street as a prank on her friend. The realistic image spread through messengers, prompting residents to alert police and sending hunters with equipment to search for the nonexistent animal. The incident reached the district head, causing widespread fear, with one local resident too afraid to leave home or visit the store. The woman later confessed to police that the image was AI-generated, admitted guilt in court under part 9 of article 13.15 of the Russian Code of Administrative Offenses, and received a reduced fine of 15,000 rubles due to her remorse and first offense. Her iPhone 15 was not confiscated after she explained its necessity for work. This marks the second similar case involving AI-generated bears, following a 30,000-ruble fine and iPhone 11 confiscation in Duldurga, Zabaykalye region, in September.
Molniya Messenger Debuts in RuStore as Paid Alternative with End-to-End Encryption
Russian company Red Soft and Chinese partner Passion Tech have released the Molniya messenger on the RuStore platform. The Android application requires a one-time payment of 750 rubles with no additional in-app purchases. Key features include personal and group chats, audio and video calls, channels, a social feed, and short videos, all protected by default end-to-end encryption. Users can send files up to 4 GB, organize up to 30 chat folders, pin 15 conversations or channels, and subscribe to as many as 1,000 channels. The developers aim to reach 15 million users within 18 months after launch. The project was originally scheduled for early 2026 but became available earlier than planned.