Open truekonrads opened 4 years ago
I looked at this and see that the actually record's event id does no bit masking in this library:
https://github.com/omerbenamram/evtx/blob/master/src/evtx_record.rs#L50
Thus, this should maintain the instance id (as no bit mask is applied). Use the event record's event_record_id attribute rather than the serialized value. I believe the python bindings also preserves this value. Let me know if you find this is not the case.
While InstanceID is not documented in Metz' documentation of EVTX structure, this is the only other value from timestamp, size, and signature outside of the XML data: https://github.com/libyal/libevtx/blob/master/documentation/Windows%20XML%20Event%20Log%20(EVTX).asciidoc#32-event-record
Evtx'es have a property "InstanceID" which is related to EventID:
Taken from here: https://evotec.xyz/powershell-everything-you-wanted-to-know-about-event-logs/
I would very much like to have InstanceID read in. It isn't in the XML data; XML data contains EventID
I don't know enough about evtx structure to offer a patch.
Cross post with pyevtx-rs/issues/9