### Install `evtx` Binary Utility

Source: https://github.com/omerbenamram/evtx/blob/master/README.md

Instructions for obtaining and installing the `evtx_dump` command-line utility, either by downloading pre-built releases for Windows, macOS, and Linux, or by compiling from source using Cargo.

```Shell
cargo install evtx
```

--------------------------------

### Batch Process EVTX Files with `fd` and `evtx_dump`

Source: https://github.com/omerbenamram/evtx/blob/master/README.md

Examples of combining `evtx_dump` with `fd` for efficient batch processing of multiple EVTX files. This includes converting all EVTX files in a directory to a single JSON Lines file, creating XML files next to each original EVTX file, and adding the source file path to JSON output using `xargs` and `jq`.

```Shell
fd -e evtx -x evtx_dump -o jsonl
```

```Shell
fd -e evtx -x evtx_dump '{}' -f '{.}.xml
```

```Shell
fd -a -e evtx | xargs -I input sh -c "evtx_dump -o jsonl input | jq --arg path \"input\" '. + {path: \$path}'"
```

--------------------------------

### Build Rust EVTX Parser

Source: https://github.com/omerbenamram/evtx/blob/master/CLAUDE.md

Commands to compile the Rust EVTX parser, including options for release builds, enabling fast allocators, multithreading, and Profile-Guided Optimization (PGO) for Linux.

```Shell
cargo build --release
```

```Shell
cargo build --release --features fast-alloc
```

```Shell
cargo build --release --features multithreading
```

```Shell
./build_pgo.sh
```

--------------------------------

### Run EVTX Dump Utility

Source: https://github.com/omerbenamram/evtx/blob/master/CLAUDE.md

Commands to run the `evtx_dump` utility for processing EVTX files, including options to specify input files, output formats like JSON, and direct output to a file.

```Shell
evtx_dump [options] <evtx_file>
```

```Shell
evtx_dump -o json <evtx_file>
```

```Shell
evtx_dump -f <output_file> -o json <input_file>
```

--------------------------------

### Test Rust EVTX Parser

Source: https://github.com/omerbenamram/evtx/blob/master/CLAUDE.md

Commands to execute tests for the Rust EVTX parser, allowing for running all tests, specific tests by name, tests with debug logging enabled, and performance benchmarks.

```Shell
cargo test
```

```Shell
cargo test test_name
```

```Shell
RUST_LOG=debug cargo test
```

```Shell
cargo bench
```

--------------------------------

### Parse EVTX Files as a Rust Library

Source: https://github.com/omerbenamram/evtx/blob/master/README.md

Illustrates how to use the `evtx` crate as a Rust library to parse an EVTX file. It shows how to create an `EvtxParser` from a file path, iterate through records, and print their ID and data, while handling potential errors. Multithreading is enabled by default when compiling with the 'multithreading' feature.

```Rust
use evtx::EvtxParser;
use std::path::PathBuf;

// Change this to a path of your .evtx sample. 
let fp = PathBuf::from(format!("{}/samples/security.evtx", std::env::var("CARGO_MANIFEST_DIR").unwrap())); 

let mut parser = EvtxParser::from_path(fp).unwrap();
for record in parser.records() {
    match record {
        Ok(r) => println!("Record {}\n{}", r.event_record_id, r.data),
        Err(e) => eprintln!("{}", e),
    }
}
```

--------------------------------

### Convert EVTX Files to XML or JSON using `evtx_dump`

Source: https://github.com/omerbenamram/evtx/blob/master/README.md

Demonstrates basic command-line usage of `evtx_dump` to convert an EVTX file's contents to XML (default) or JSON, optionally redirecting output to a specified file. By default, `evtx_dump` uses multithreading, which may result in out-of-order records.

```Shell
evtx_dump <evtx_file>
```

```Shell
evtx_dump -o json <evtx_file>
```

```Shell
evtx_dump -f <output_file> -o json <input_file>
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.