// REFERENCE
Event log (EVTX) signature
Signature (hex): 45 6C 66 46 69 6C 65 00 (ElfFile)
Medium risk
A Windows event log (.evtx) starts with 45 6C 66 46 69 6C 65 00 (ElfFile\0). It's the centerpiece of Windows forensics and IR: logons, processes and attacker traces.
Related tools
Work with this in:
Related
sqlite
SQLite database signature pcap
PCAP capture signature pcapng
PCAPNG capture signature torrent
.torrent signature eml
EML email signature woff2
WOFF2 font signature
SQLite database signature pcap
PCAP capture signature pcapng
PCAPNG capture signature torrent
.torrent signature eml
EML email signature woff2
WOFF2 font signature
Signatures verifiable with CyberEscudo's magic-bytes identifier. Educational content.