Windows 10事件日志解析

Question

Is it possible to parse exported or saved .evtx files and get relevant information (Xml details)of Windows 10 Event Logs using System.Diagnostics.EventLog class in visual studio.

I need to develop a tool which can extract forensically relevant eventlog information. If Not, what are the alternatives?

Answer 1

You could use the powershell cmdlet Get-WinEvent to extract information from an evtx file. This can be called also from a C# program using System.Management.Automation.