Struct s4lib::readers::evtxreader::EvtxReader

pub struct EvtxReader { /* private fields */ }

A wrapper for using EvtxParser to read a evtx format file.

An EvtxReader presumes the file events are not stored in chronological order.

.evtx files in the wild were found to store events in a non-chronological order, e.g. the XML value at Event.System.TimeCreated are not necessarily in ascending order.
About 2/3 of the files on a long-running Windows 11 system were found to be in this “out of order” state.
More accurately, using evtx_dump to dump a .evtx file displayed events evtx_dump). Either way, that is the underlying library used to read the .evtx files so it’s a problem for this program.
This EvtxReader wrapper sorts the events by timestamp and then by order of enumeration.
Unfortunately, this means the entire file must be read into memory before Events can be further processed and then printed.
Also see Issue #86.

Implementations

impl<'a> EvtxReader

Implement the EvtxReader.

pub fn new(path: FPath, filetype: FileType) -> Result<EvtxReader>

Create a new EvtxReader.

NOTE: should not attempt any file reads here, similar to other *Readers::new()

pub fn mtime(&self) -> SystemTime

pub fn analyze( &mut self, dt_filter_after: &DateTimeLOpt, dt_filter_before: &DateTimeLOpt )

Read the entire file and store in order.

This should be called once before reading the via next.

pub fn next(&mut self) -> Option<Evtx>

pub fn count_events_processed(&self) -> Count

Count of Evtxs processed by this EvtxReader (i.e. self.events_processed).

pub fn count_events_accepted(&self) -> Count

pub const fn path(&self) -> &FPath

pub const fn filetype(&self) -> FileType

pub const fn filesz(&self) -> FileSz

pub fn dt_first_processed(&self) -> DateTimeLOpt

return the DateTimeL of the first Evtx processed

pub fn dt_last_processed(&self) -> DateTimeLOpt

return the DateTimeL of the last Evtx processed

pub fn dt_first_accepted(&self) -> DateTimeLOpt

return the DateTimeL of the first Evtx accepted by the datetime filters

pub fn dt_last_accepted(&self) -> DateTimeLOpt

return the DateTimeL of the last Evtx accepted by the datetime filters

pub fn summary(&self) -> SummaryEvtxReader

Return an up-to-date SummaryEvtxReader instance for this EvtxReader.

pub fn summary_complete(&self) -> Summary

Return an up-to-date Summary instance for this EvtxReader.

Trait Implementations

impl<'a> Debug for EvtxReader

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.