python-evtx
A pure Python parser for Windows Event Log (.evtx) files that enables cross-platform forensic analysis of Windows system events.
A pure Python parser for Windows Event Log (.evtx) files that enables cross-platform forensic analysis of Windows system events.
Checked October 2026.
python-evtx is a pure Python parser designed for analyzing Windows Event Log files with the .evtx extension. The module enables cross-platform examination of Windows event logs, allowing investigators to review Windows 7 and later system logs from Mac or Linux workstations.
The parser provides programmatic access to multiple components of EVTX files including File headers, Chunk headers, record templates, and individual event entries. This functionality supports detailed forensic analysis of Windows system activities and security events.
The tool's implementation draws from Andreas Schuster's Perl-based "Parse-Evtx" parser, adapting the structure definitions and parsing methodologies for Python environments. This cross-platform capability makes it valuable for digital forensics workflows that require Windows event log analysis on non-Windows systems.
No core features are listed for this product yet, so check the vendor's documentation for the full feature list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
Common questions about python-evtx: features, pricing and alternatives.
python-evtx is a product in the Digital Forensics category. It covers Parser, Windows Event Logs and Windows.
python-evtx is free. Download and setup instructions are at https://github.com/williballenthin/python-evtx/.
Alternatives to python-evtx listed on CybersecTools:
Compare all python-evtx alternatives at https://cybersectools.com/alternatives/python-evtx
python-evtx is available as on-premises software. It is listed for startups, small businesses, mid-market companies and enterprises. It is free.
Side by side: features, pricing model and the company behind each one.
PowerForensics is a PowerShell digital forensics framework for hard drive forensic analysis.
A command-line tool that parses Google Protobuf encoded data without schema definitions and displays the content in a readable, colored format.
A PowerShell-based incident response and live forensic data acquisition tool for Windows hosts.
Open source Python library for NTFS analysis
A cybersecurity tool for collecting and analyzing forensic artifacts on live systems.
Recoverjpeg is a tool for recovering JPEG images from damaged storage media.
On our shortlist?
No shortlist covers this product's category yet. The closest is Best MDR Solutions for Business.
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,030 products.
Connect your AI
