search

3gstudent / Eventlogedit-evtx--Evolution

Remove individual lines from Windows XML Event Log (EVTX) files
256 stars 62 forks source link

openfile error #16

Closed HennelovaZuzana closed 1 year ago

HennelovaZuzana commented 1 year ago

Hello, I get openfile error when running DeleteRecordofFile.exe from commandline. What does it mean? Any suggestions how to fix it? I dont have the logs open. Thanx.

HennelovaZuzana commented 1 year ago

I have also tried to run the tool after suspending event log services, however it still gives the same error.

3gstudent commented 1 year ago

The file(c:\Windows\system32\winevt\logs\security) is in use. You can't directly modify it. This program(DeleteRecordofFileEx.cpp) is used to modify the unoccupied log file.

3gstudent commented 1 year ago

https://github.com/3gstudent/Eventlogedit-evtx--Evolution/blob/master/DeleteRecordofFile.cpp#L436

HennelovaZuzana commented 1 year ago

Thanx, I see now why the error is raised.

But shouldnt suspending the log services work? I assume those are the only ones which are directly accessing the log files. I tried both SuspendorResumeTid.cpp and SuspendorResumeTidEx.cpp and i also tried Phant0m to stop logging threads, however it didnt help.

It didnt even work on copied logs, which again I believe are not opened by any other service. But that is only assumption.

how can I make the log file unoccupied for this tool to work?

3gstudent commented 1 year ago

run this: wevtutil.exe epl Setup c:\test\Setup.evtx