{"success":true,"data":{"ext":"evt","name":"Windows Event Viewer file","description":"Windows Event Viewer file (EVT) is a proprietary event log format developed and maintained by Microsoft for use in Microsoft Windows. It stores system, security, and application event records and was used by Windows Event Viewer and related administrative tools to review logs and troubleshoot system behavior. The format is associated with older Windows versions and has largely been replaced by newer event log formats; files are generally safe, though logs may contain sensitive operational information.","mime":[],"risk_level":"Safe","signatures":[{"hex":"4C 66 4C 65","offset":0,"sources":[{"name":"Wikipedia","url":"https://en.wikipedia.org/wiki/List_of_file_signatures"}]},{"hex":"30 00 00 00 4C 66 4C 65","offset":0,"sources":[{"name":"Gary Kessler","url":"https://www.garykessler.net/library/file_sigs_GCK_latest.html"}]}],"related":[],"usage":{"python":"def is_evt(file_path: str) -> bool:\n    \"\"\"Check if file is a valid EVT by magic bytes.\"\"\"\n    signature = bytes([0x4C, 0x66, 0x4C, 0x65])\n    with open(file_path, \"rb\") as f:\n        return f.read(4) == signature","node":"function isEVT(buffer: Buffer): boolean {\n  const signature = Buffer.from([0x4C, 0x66, 0x4C, 0x65]);\n  return buffer.subarray(0, 4).equals(signature);\n}","go":"func IsEVT(data []byte) bool {\n    signature := []byte{0x4C, 0x66, 0x4C, 0x65}\n    if len(data) < 4 {\n        return false\n    }\n    return bytes.Equal(data[:4], signature)\n}"}}}