Why can't the same single log deletion method used for EVTX files be applied to EVT files?
The EVT file structure does not include a unique identifier like EventRecordID, which is present in EVTX files. Without this unique value, it's impossible to locate and delete a specific log entry directly. Instead, the approach for EVT files uses the log creation time (time_t) as an input parameter, allowing deletion of all logs within a specified time range. This method is detailed in the Windows Event Viewer Log (EVT) Single Log Deletion (Part 2) – Program Implementation for Deleting Log Records within a Specified Time Range from EVT Files article.
EVTEVTXEventRecordIDtime_tlog deletion