1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
|
.Dd April 12, 2018
.Dt libevtx 3
.Os libevtx
.Sh NAME
.Nm libevtx.h
.Nd Library to access the Windows XML Event Log (EVTX) format
.Sh LIBRARY
.Lb libevtx
.Sh SYNOPSIS
.In libevtx.h
.Pp
Support functions
.Ft const char *
.Fn libevtx_get_version "void"
.Ft int
.Fn libevtx_get_access_flags_read "void"
.Ft int
.Fn libevtx_get_codepage "int *codepage, libevtx_error_t **error"
.Ft int
.Fn libevtx_set_codepage "int codepage, libevtx_error_t **error"
.Ft int
.Fn libevtx_check_file_signature "const char *filename, libevtx_error_t **error"
.Pp
Available when compiled with wide character string support:
.Ft int
.Fn libevtx_check_file_signature_wide "const wchar_t *filename, libevtx_error_t **error"
.Pp
Available when compiled with libbfio support:
.Ft int
.Fn libevtx_check_file_signature_file_io_handle "libbfio_handle_t *bfio_handle, libevtx_error_t **error"
.Pp
Notify functions
.Ft void
.Fn libevtx_notify_set_verbose "int verbose"
.Ft int
.Fn libevtx_notify_set_stream "FILE *stream, libevtx_error_t **error"
.Ft int
.Fn libevtx_notify_stream_open "const char *filename, libevtx_error_t **error"
.Ft int
.Fn libevtx_notify_stream_close "libevtx_error_t **error"
.Pp
Error functions
.Ft void
.Fn libevtx_error_free "libevtx_error_t **error"
.Ft int
.Fn libevtx_error_fprint "libevtx_error_t *error, FILE *stream"
.Ft int
.Fn libevtx_error_sprint "libevtx_error_t *error, char *string, size_t size"
.Ft int
.Fn libevtx_error_backtrace_fprint "libevtx_error_t *error, FILE *stream"
.Ft int
.Fn libevtx_error_backtrace_sprint "libevtx_error_t *error, char *string, size_t size"
.Pp
File functions
.Ft int
.Fn libevtx_file_initialize "libevtx_file_t **file, libevtx_error_t **error"
.Ft int
.Fn libevtx_file_free "libevtx_file_t **file, libevtx_error_t **error"
.Ft int
.Fn libevtx_file_signal_abort "libevtx_file_t *file, libevtx_error_t **error"
.Ft int
.Fn libevtx_file_open "libevtx_file_t *file, const char *filename, int access_flags, libevtx_error_t **error"
.Ft int
.Fn libevtx_file_close "libevtx_file_t *file, libevtx_error_t **error"
.Ft int
.Fn libevtx_file_is_corrupted "libevtx_file_t *file, libevtx_error_t **error"
.Ft int
.Fn libevtx_file_get_ascii_codepage "libevtx_file_t *file, int *ascii_codepage, libevtx_error_t **error"
.Ft int
.Fn libevtx_file_set_ascii_codepage "libevtx_file_t *file, int ascii_codepage, libevtx_error_t **error"
.Ft int
.Fn libevtx_file_get_format_version "libevtx_file_t *file, uint16_t *major_version, uint16_t *minor_version, libevtx_error_t **error"
.Ft int
.Fn libevtx_file_get_flags "libevtx_file_t *file, uint32_t *flags, libevtx_error_t **error"
.Ft int
.Fn libevtx_file_get_number_of_records "libevtx_file_t *file, int *number_of_records, libevtx_error_t **error"
.Ft int
.Fn libevtx_file_get_record_by_index "libevtx_file_t *file, int record_index, libevtx_record_t **record, libevtx_error_t **error"
.Ft int
.Fn libevtx_file_get_number_of_recovered_records "libevtx_file_t *file, int *number_of_records, libevtx_error_t **error"
.Ft int
.Fn libevtx_file_get_recovered_record_by_index "libevtx_file_t *file, int record_index, libevtx_record_t **record, libevtx_error_t **error"
.Pp
Available when compiled with wide character string support:
.Ft int
.Fn libevtx_file_open_wide "libevtx_file_t *file, const wchar_t *filename, int access_flags, libevtx_error_t **error"
.Pp
Available when compiled with libbfio support:
.Ft int
.Fn libevtx_file_open_file_io_handle "libevtx_file_t *file, libbfio_handle_t *file_io_handle, int access_flags, libevtx_error_t **error"
.Pp
Record functions
.Ft int
.Fn libevtx_record_free "libevtx_record_t **record, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_offset "libevtx_record_t *record, off64_t *offset, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_identifier "libevtx_record_t *record, uint64_t *identifier, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_written_time "libevtx_record_t *record, uint64_t *filetime, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_event_identifier "libevtx_record_t *record, uint32_t *event_identifier, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_event_identifier_qualifiers "libevtx_record_t *record, uint32_t *event_identifier_qualifiers, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_event_level "libevtx_record_t *record, uint8_t *event_level, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_utf8_provider_identifier_size "libevtx_record_t *record, size_t *utf8_string_size, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_utf8_provider_identifier "libevtx_record_t *record, uint8_t *utf8_string, size_t utf8_string_size, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_utf16_provider_identifier_size "libevtx_record_t *record, size_t *utf16_string_size, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_utf16_provider_identifier "libevtx_record_t *record, uint16_t *utf16_string, size_t utf16_string_size, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_utf8_source_name_size "libevtx_record_t *record, size_t *utf8_string_size, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_utf8_source_name "libevtx_record_t *record, uint8_t *utf8_string, size_t utf8_string_size, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_utf16_source_name_size "libevtx_record_t *record, size_t *utf16_string_size, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_utf16_source_name "libevtx_record_t *record, uint16_t *utf16_string, size_t utf16_string_size, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_utf8_computer_name_size "libevtx_record_t *record, size_t *utf8_string_size, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_utf8_computer_name "libevtx_record_t *record, uint8_t *utf8_string, size_t utf8_string_size, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_utf16_computer_name_size "libevtx_record_t *record, size_t *utf16_string_size, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_utf16_computer_name "libevtx_record_t *record, uint16_t *utf16_string, size_t utf16_string_size, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_utf8_user_security_identifier_size "libevtx_record_t *record, size_t *utf8_string_size, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_utf8_user_security_identifier "libevtx_record_t *record, uint8_t *utf8_string, size_t utf8_string_size, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_utf16_user_security_identifier_size "libevtx_record_t *record, size_t *utf16_string_size, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_utf16_user_security_identifier "libevtx_record_t *record, uint16_t *utf16_string, size_t utf16_string_size, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_parse_data_with_template_definition "libevtx_record_t *record, libevtx_template_definition_t *template_definition, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_number_of_strings "libevtx_record_t *record, int *number_of_strings, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_utf8_string_size "libevtx_record_t *record, int string_index, size_t *utf8_string_size, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_utf8_string "libevtx_record_t *record, int string_index, uint8_t *utf8_string, size_t utf8_string_size, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_utf16_string_size "libevtx_record_t *record, int string_index, size_t *utf16_string_size, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_utf16_string "libevtx_record_t *record, int string_index, uint16_t *utf16_string, size_t utf16_string_size, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_data_size "libevtx_record_t *record, size_t *data_size, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_data "libevtx_record_t *record, uint8_t *data, size_t data_size, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_utf8_xml_string_size "libevtx_record_t *record, size_t *utf8_string_size, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_utf8_xml_string "libevtx_record_t *record, uint8_t *utf8_string, size_t utf8_string_size, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_utf16_xml_string_size "libevtx_record_t *record, size_t *utf16_string_size, libevtx_error_t **error"
.Ft int
.Fn libevtx_record_get_utf16_xml_string "libevtx_record_t *record, uint16_t *utf16_string, size_t utf16_string_size, libevtx_error_t **error"
.Pp
Template definition functions
.Ft int
.Fn libevtx_template_definition_initialize "libevtx_template_definition_t **template_definition, libevtx_error_t **error"
.Ft int
.Fn libevtx_template_definition_free "libevtx_template_definition_t **template_definition, libevtx_error_t **error"
.Ft int
.Fn libevtx_template_definition_set_data "libevtx_template_definition_t *template_definition, const uint8_t *data, size_t data_size, uint32_t data_offset, libevtx_error_t **error"
.Sh DESCRIPTION
The
.Fn libevtx_get_version
function is used to retrieve the library version.
.Sh RETURN VALUES
Most of the functions return NULL or \-1 on error, dependent on the return type.
For the actual return values see "libevtx.h".
.Sh ENVIRONMENT
None
.Sh FILES
None
.Sh NOTES
libevtx allows to be compiled with wide character support (wchar_t).
To compile libevtx with wide character support use:
.Ar ./configure --enable-wide-character-type=yes
or define:
.Ar _UNICODE
or
.Ar UNICODE
during compilation.
.Ar LIBEVTX_WIDE_CHARACTER_TYPE
in libevtx/features.h can be used to determine if libevtx was compiled with wide character support.
.Sh BUGS
Please report bugs of any kind on the project issue tracker: https://github.com/libyal/libevtx/issues
.Sh AUTHOR
These man pages are generated from "libevtx.h".
.Sh COPYRIGHT
Copyright (C) 2011-2018, Joachim Metz <joachim.metz@gmail.com>.
This is free software; see the source for copying conditions.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
.Sh SEE ALSO
the libevtx.h include file
|
