One Day Sec

How is the time parameter handled when deleting EVT log records within a time range?

The log creation time in EVT files is stored as a time_t value (calendar time), which represents seconds since 1970-01-01 00:00:00 UTC. The program requires conversion between user‑supplied date/time strings (e.g., "2018-7-16 17:46:17") and time_t using functions like `mktime` and `_gmtime64_s`. Care must be taken to account for time zone differences; local time can be obtained via `_localtime64_s`. These conversions ensure the start and end times correctly match the `TimeGenerated` field in each log record.
time_tGMTUTClocal timetime conversionTimeGenerated

Browse all Q&A →