Why can't you directly copy SysEvent.Evt from `%systemroot%\system32\config` and open it in Event Viewer?

When the EVT file is in use by the system, the file header is not synchronously updated with current log changes, causing the copied file to appear corrupt. The article demonstrates that repairing the file header—by correcting the end-of-file offset and other fields—allows the file to open normally. This is why the preferred method is to save the log via 'Save Log File As...' in Event Viewer, which produces a properly formatted file.