Sherlock Forensics Universal Events Viewer Stop reading event IDs. Start reading sentences.

EVTX is the modern Windows event log format introduced with Windows Vista and Server 2008, replacing the older EVT format used in Windows XP and Server 2003. Sherlock Forensics Universal Events Viewer is a standalone EVTX viewer + EVTX parser that reads both formats without requiring Microsoft Event Viewer, the Windows SDK, the EvtxECmd CLI or any admin permissions. Open any .evtx file from any Windows source: a workstation under examination, an EVTX file copied from a compromised endpoint, an EVTX file extracted from a disk image, an EVTX file produced by a Sysmon installation.

Most "free EVTX viewers" require either importing the .evtx file into Microsoft's Event Viewer (which itself only loads the file if Windows trusts the source and you have UAC consent) or installing the EvtxECmd parser via the Eric Zimmerman tools bundle. Both paths take 10 to 30 minutes and require admin rights. Sherlock Universal Events Viewer opens the same .evtx file in one click with no admin permission requested, no SDK install, no command-line knowledge.

The Sherlock EVTX parser handles common edge cases that break other tools: corrupted .evtx headers, partial event records from interrupted writes, channel-specific schema differences between Application, Security, System and the Microsoft-Windows-* sub-channels. The same EVTX viewer surface handles modern Windows 10/11 event logs and legacy Server 2008 event logs identically.

For a single ad-hoc question ("what does this .evtx file contain?") the free Sherlock EVTX viewer gets you the answer in 30 seconds. For forensic-grade analysis with chain-of-custody output, the Forensic Edition adds court-ready PDF reports, SHA-256 hashing per event and structured forensic export below.

Event log forensics on a compromised Windows endpoint looks for specific high-value patterns. The Windows security log records the same event taxonomy Microsoft documents in the Security Auditing reference, but reading the raw EVTX without analytical structure misses the patterns that matter to an incident responder. Sherlock Forensics Universal Events Viewer applies forensic-IR detection rules across the event log timeline so the compromise indicators surface in the triage view, not the raw XML.

Logon Failures and Brute-Force Detection

Event ID 4625 is the failed logon record in the Windows security log. A single Event ID 4625 is unremarkable. A cluster of Event ID 4625 events with the same source workstation, different account names and minute-scale timestamps is a brute-force or password-spray attack signature. Sherlock UEV correlates Event ID 4625 events across the failed-logon timeline, surfaces the cluster patterns and flags the affected account names. The companion Event ID 4624 (successful logon) is correlated alongside Event ID 4625 so the responder sees when a brute force actually succeeded.

Credential Dumping Indicators

Credential dumping is the post-compromise step where an attacker extracts password hashes or Kerberos tickets from a compromised endpoint to enable lateral movement. The Windows security log records credential-dumping-adjacent activity in Event ID 4672 (special privileges assigned to new logon, common for SYSTEM and admin sessions) and Event ID 4648 (logon attempted with explicit credentials, common in lateral movement workflows). Sherlock UEV flags Event ID 4672 anomalies (SYSTEM logons from non-service accounts), unusual Event ID 4648 patterns (explicit credentials presented to non-domain-controller targets) and other credential dumping compromise indicators.

Lateral Movement and Kerberos Ticket Abuse

Lateral movement is the step where an attacker moves from the initial compromise point to other endpoints on the network. The Kerberos ticket events (Event ID 4768 Kerberos authentication ticket, Event ID 4769 Kerberos service ticket, Event ID 4770 Kerberos ticket renewal, Event ID 4771 Kerberos pre-authentication failure) carry the signal for golden ticket and silver ticket attacks. A golden ticket attack issues a Kerberos ticket-granting ticket with a 10-year lifetime from a stolen krbtgt account hash; the lateral movement that follows shows up as Event ID 4769 service ticket requests from anomalous source workstations. Sherlock UEV's forensic-IR rules detect the Kerberos ticket anomalies and flag the lateral movement patterns in the timeline view.

The combined logon failures + credential dumping + lateral movement detection surface is what makes the Forensic Edition court-defensible for incident response work. This event log forensics methodology is what separates Sherlock Universal Events Viewer from a generic EVTX reader and event log forensics is exactly the buyer-intent the Forensic Edition is priced to serve. Each detected compromise indicator carries timestamp, source workstation, target system and Event ID metadata in the forensic PDF report below. For the parallel mobile-side incident response workflow (Android device forensics) see the Sherlock Forensics Android Acquirer. For the broader incident response timeline see the first 72 hours of a data breach and the ransomware recovery process.

Windows Event Viewer is built into Windows and free. For an admin checking why one service crashed on their own workstation, Event Viewer is the right tool. For a forensic responder reading event logs from a compromised endpoint, looking for lateral movement signals, credential dumping indicators or Kerberos ticket abuse across thousands of events, the manual workflow in Event Viewer takes hours per investigation. Sherlock UEV applies forensic-IR detection rules to the same EVTX files and surfaces the patterns in the timeline view. The Forensic Edition exports the findings to a court-ready PDF with SHA-256 hashing per event.