{"id":24445,"library":"python-evtx","title":"python-evtx","description":"A pure Python parser for Windows event log files (.evtx). Version 0.8.1 supports Python >=3.9, provides XML and JSON dump functionality, and extracts event records from EVTX files. Maintenance is active with occasional releases.","status":"active","version":"0.8.1","language":"python","source_language":"en","source_url":"https://github.com/williballenthin/python-evtx","tags":["forensics","windows","event-log","parser","evtx"],"install":[{"cmd":"pip install python-evtx","lang":"bash","label":"Install from PyPI"}],"dependencies":[{"reason":"Used for XML output of event records","package":"lxml","optional":true},{"reason":"Compatibility layer (deprecated in v0.8.0 but may still be pulled)","package":"six","optional":true}],"imports":[{"wrong":"from evtx import Evtx","symbol":"Evtx","correct":"from Evtx import Evtx"}],"quickstart":{"code":"from evtx import PyEvtxParser\n\nparser = PyEvtxParser('example.evtx')\nfor record in parser.records():\n    print(record['data'])","lang":"python","description":"Open an EVTX file and iterate over records; each record contains 'event_data' (XML string) and 'data' (raw string when JSON not available)."},"warnings":[{"fix":"Upgrade python-evtx to v0.8.1 and use Python >=3.8.","message":"Python 2.7 support removed in v0.8.0; Python 3.8+ required. v0.7.x development had pinned dependencies due to Python 2 deprecation. Upgrade to v0.8.1.","severity":"breaking","affected_versions":"<0.8.0"},{"fix":"Use correct import: from evtx import Evtx or from evtx import PyEvtxParser","message":"The module name is 'evtx', not 'python_evtx' or 'PyEvtx'. Import with 'from evtx import Evtx'.","severity":"gotcha","affected_versions":"all"},{"fix":"Iterate over parser.records() instead of list(parser.records()) for large files.","message":"Large EVTX files can consume significant memory if records are loaded all at once. Use the iterator interface (parser.records()) rather than converting to a list.","severity":"gotcha","affected_versions":"all"},{"fix":"Install lxml via pip to ensure full XML support.","message":"The lxml library is optional but recommended for XML output. Without lxml, XML generation may fall back to a less robust implementation.","severity":"deprecated","affected_versions":"all"}],"env_vars":null,"search_vec":"'0.8.1':15 '3.9':18 'activ':34 'dump':23 'event':10,27,41 'event-log':40 'evtx':3,13,30,44 'extract':26 'file':12,31 'forens':38 'function':24 'json':22 'log':11,42 'mainten':32 'occasion':36 'parser':7,43 'provid':19 'pure':5 'python':2,6,17 'python-evtx':1 'record':28 'releas':37 'support':16 'version':14 'window':9,39 'xml':20","created_at":"2026-05-01T08:13:06.738153+00:00","updated_at":"2026-05-01T08:13:06.738153+00:00","problems":null,"ecosystem":"pypi","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":"0.8.1","cli_name":"evtx_dump","cli_version":"Traceback (most recent call last):","type":"library","homepage":null,"github":"https://github.com/williballenthin/python-evtx","docs":null,"changelog":null,"pypi":"https://pypi.org/project/python-evtx/","npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["data","serialization","database"],"base_url":null,"auth_type":null,"provenance":{"verified_status":"passing","verified_at":"2026-07-03","last_verified":"2026-07-03","next_check":"2026-08-02","install_tag":null}}