Log Parser

Had an instance where Log2timeline would not work on .evtx files for what ever reason.

Decided to try Log Parser v2.2 and it works.  I had a bunch of .evtx files and wanted to parse them into one .xlsx file for easy sorting and searching.

I used the command line:

logparser -i:EVT -o:CSV "SELECT * FROM e:\directory\*.*" > c:\output.csv

Haven’t figured out how to recursively pass through multiple directories.