NAME

libevt.h — Library to access the Windows Event Log (EVT) format

LIBRARY

library “libevt”

SYNOPSIS

#include <libevt.h>

Support functions
const char *
libevt_get_version(void);

int
libevt_get_access_flags_read();

int
libevt_get_codepage(int *codepage, libevt_error_t **error);

int
libevt_set_codepage(int codepage, libevt_error_t **error);

int
libevt_check_file_signature(const char *filename, libevt_error_t **error);

Available when compiled with wide character string support:
int
libevt_check_file_signature_wide(const wchar_t *filename, libevt_error_t **error);

Available when compiled with libbfio support:
int
libevt_check_file_signature_file_io_handle(libbfio_handle_t *file_io_handle, libevt_error_t **error);

Notify functions
void
libevt_notify_set_verbose(int verbose);

int
libevt_notify_set_stream(FILE *stream, libevt_error_t **error);

int
libevt_notify_stream_open(const char *filename, libevt_error_t **error);

int
libevt_notify_stream_close(libevt_error_t **error);

Error functions
void
libevt_error_free(libevt_error_t **error);

int
libevt_error_fprint(libevt_error_t *error, FILE *stream);

int
libevt_error_sprint(libevt_error_t *error, char *string, size_t size);

int
libevt_error_backtrace_fprint(libevt_error_t *error, FILE *stream);

int
libevt_error_backtrace_sprint(libevt_error_t *error, char *string, size_t size);

File functions
int
libevt_file_initialize(libevt_file_t **file, libevt_error_t **error);

int
libevt_file_free(libevt_file_t **file, libevt_error_t **error);

int
libevt_file_open(libevt_file_t *file, const char *filename, int access_flags, libevt_error_t **error);

int
libevt_file_close(libevt_file_t *file, libevt_error_t **error);

int
libevt_file_is_corrupted(libevt_file_t *file, libevt_error_t **error);

int
libevt_file_get_ascii_codepage(libevt_file_t *file, int *ascii_codepage, libevt_error_t **error);

int
libevt_file_set_ascii_codepage(libevt_file_t *file, int ascii_codepage, libevt_error_t **error);

int
libevt_file_get_version(libevt_file_t *file, uint32_t *major_version, uint32_t *minor_version, libevt_error_t **error);

int
libevt_file_get_flags(libevt_file_t *file, uint32_t *flags, libevt_error_t **error);

int
libevt_file_get_number_of_records(libevt_file_t *file, int *number_of_records, libevt_error_t **error);

int
libevt_file_get_record(libevt_file_t *file, int record_index, libevt_record_t **record, libevt_error_t **error);

int
libevt_file_get_number_of_recovered_records(libevt_file_t *file, int *number_of_records, libevt_error_t **error);

int
libevt_file_get_recovered_record(libevt_file_t *file, int record_index, libevt_record_t **record, libevt_error_t **error);

Record functions
int
libevt_record_free(libevt_record_t **record, libevt_error_t **error);

int
libevt_record_get_offset(libevt_record_t *record, off64_t *offset, libevt_error_t **error);

int
libevt_record_get_identifier(libevt_record_t *record, uint32_t *identifier, libevt_error_t **error);

int
libevt_record_get_creation_time(libevt_record_t *record, uint32_t *creation_time, libevt_error_t **error);

int
libevt_record_get_written_time(libevt_record_t *record, uint32_t *written_time, libevt_error_t **error);

int
libevt_record_get_event_identifier(libevt_record_t *record, uint32_t *event_identifier, libevt_error_t **error);

int
libevt_record_get_event_type(libevt_record_t *record, uint16_t *event_type, libevt_error_t **error);

int
libevt_record_get_event_category(libevt_record_t *record, uint16_t *event_category, libevt_error_t **error);

int
libevt_record_get_utf8_source_name_size(libevt_record_t *record, size_t *utf8_string_size, libevt_error_t **error);

int
libevt_record_get_utf8_source_name(libevt_record_t *record, uint8_t *utf8_string, size_t utf8_string_size, libevt_error_t **error);

int
libevt_record_get_utf16_source_name_size(libevt_record_t *record, size_t *utf16_string_size, libevt_error_t **error);

int
libevt_record_get_utf16_source_name(libevt_record_t *record, uint16_t *utf16_string, size_t utf16_string_size, libevt_error_t **error);

int
libevt_record_get_utf8_computer_name_size(libevt_record_t *record, size_t *utf8_string_size, libevt_error_t **error);

int
libevt_record_get_utf8_computer_name(libevt_record_t *record, uint8_t *utf8_string, size_t utf8_string_size, libevt_error_t **error);

int
libevt_record_get_utf16_computer_name_size(libevt_record_t *record, size_t *utf16_string_size, libevt_error_t **error);

int
libevt_record_get_utf16_computer_name(libevt_record_t *record, uint16_t *utf16_string, size_t utf16_string_size, libevt_error_t **error);

int
libevt_record_get_utf8_user_security_identifier_size(libevt_record_t *record, size_t *utf8_string_size, libevt_error_t **error);

int
libevt_record_get_utf8_user_security_identifier(libevt_record_t *record, uint8_t *utf8_string, size_t utf8_string_size, libevt_error_t **error);

int
libevt_record_get_utf16_user_security_identifier_size(libevt_record_t *record, size_t *utf16_string_size, libevt_error_t **error);

int
libevt_record_get_utf16_user_security_identifier(libevt_record_t *record, uint16_t *utf16_string, size_t utf16_string_size, libevt_error_t **error);

int
libevt_record_get_number_of_strings(libevt_record_t *record, int *number_of_strings, libevt_error_t **error);

int
libevt_record_get_utf8_string_size(libevt_record_t *record, int string_index, size_t *utf8_string_size, libevt_error_t **error);

int
libevt_record_get_utf8_string(libevt_record_t *record, int string_index, uint8_t *utf8_string, size_t utf8_string_size, libevt_error_t **error);

int
libevt_record_get_utf16_string_size(libevt_record_t *record, int string_index, size_t *utf16_string_size, libevt_error_t **error);

int
libevt_record_get_utf16_string(libevt_record_t *record, int string_index, uint16_t *utf16_string, size_t utf16_string_size, libevt_error_t **error);

int
libevt_record_get_data_size(libevt_record_t *record, size_t *data_size, libevt_error_t **error);

int
libevt_record_get_data(libevt_record_t *record, uint8_t *data, size_t data_size, libevt_error_t **error);

Available when compiled with wide character string support:
int
libevt_file_open_wide(libevt_file_t *file, const wchar_t *filename, int access_flags, libevt_error_t **error);

Available when compiled with libbfio support:
int
libevt_file_open_file_io_handle(libevt_file_t *file, libbfio_handle_t *file_io_handle, int access_flags, libevt_error_t **error);

DESCRIPTION

The libevt_get_version() function is used to retrieve the library version.

RETURN VALUES

Most of the functions return NULL or -1 on error, dependent on the return type. For the actual return values refer to libevt.h

ENVIRONMENT

None

FILES

None

NOTES

Internally libevt uses both ASCII and Unicode (UTF-16 little-endian) strings, as stored in the EVT file. ASCII strings in a EVT file contain an extended ASCII string using the codepage of the system it was created on. The function libevt_set_ascii_codepage
allows to set the required codepage for reading and writing. The default codepage is Windows 1252. Unsupported extended characters are replaced to the Unicode replacement character (U+fffd) when reading and the ASCII substitude character (0x1a) when writing.

Libevt uses either the system specific narrow or wide character strings for filenames. To compile libevt with wide character support use ./configure --enable-wide-character-type=yes
or on Windows define WINAPI
and either _UNICODE
or UNICODE

To have other code to determine if libevt was compiled with wide character support it defines LIBEVT_HAVE_WIDE_CHARACTER_TYPE
in libevt/features.h.

libevt allows to be compiled with chained IO support using libbfio. The libevt configure script will automatically detect if a compatible version of libbfio is available.

To have other code to determine if libevt was compiled with libbfio support it defines LIBEVT_HAVE_BFIO
in libevt/features.h.

BUGS

Please report bugs of any kind to <joachim.metz@gmail.com> or on the project website: http://code.google.com/p/libevt/

AUTHOR

These man pages were written by Joachim Metz.

COPYRIGHT

Copyright 2011-2014, Joachim Metz <joachim.metz@gmail.com>. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

SEE ALSO

the libevt.h include file