One Day Sec

What are the steps to delete a single log entry from an EVT file?

The deletion process involves: (1) Locating the target event record using the ELF_LOG_SIGNATURE and record number; (2) Deleting the raw bytes of that record; (3) Decrementing the record numbers of all subsequent event records by 1; (4) Updating the file header’s end-of-file offset, newest record number, and maximum file size; (5) Updating the same fields in the end-of-file record. The Part 2 article provides a programmatic implementation of this approach.
log deletionrecord number updatefile header updateend-of-file recordELF_LOG_SIGNATUREbyte deletion

Browse all Q&A →