What are the steps to delete a single log entry from an EVT file?

The deletion process involves: (1) Locating the target event record using the ELF_LOG_SIGNATURE and record number; (2) Deleting the raw bytes of that record; (3) Decrementing the record numbers of all subsequent event records by 1; (4) Updating the file header’s end-of-file offset, newest record number, and maximum file size; (5) Updating the same fields in the end-of-file record. The [Part 2 article](/news/windows-event-viewer-log-evt-single-log-deletion-part-2-program-implementation-for-deleting-log-records-within-a-specified-time-range-from-evt-files) provides a programmatic implementation of this approach.