Open EVT files in your browser
The event logs of Windows NT, 2000, XP and Server 2003. Look through one right here, every event a row, without an old Windows to read it. Nothing leaves your device.
Or drop it anywhere on this page
What you'll see
Your event log opens as a row for each event, from the oldest it kept to the newest.
- A row for each event • Time, type, source, ID and computer
- Sort and filter • Counts for every column
- The strings it was logged with • Its data in hex
- Export • Save as CSV, Excel, JSON or Parquet
About EVT
Windows NT kept its event logs as .evt files from 1993, and Windows 2000, XP and Server 2003 did too: AppEvent.Evt, SysEvent.Evt and SecEvent.Evt in C:\Windows\System32\config. Windows Vista replaced them with EVTX, and Event Viewer on later Windows opens an old one through Open Saved Log.
An EVT is a 48 byte header and a ring of records: each event's number, the times it was made and written, its ID, type and category, the source that logged it, the computer, the user's security ID, the strings it was logged with and its data. When the log is full Windows writes over its oldest records, so the oldest one left can start anywhere, and a record that reaches the end of the file goes on after the header.
Filepeek reads the ring from its oldest record round to the newest: a row for each event, with its time in UTC, type, event ID, category, source, computer, user and strings, and its data in hex. Sort, filter and search them like any table. Event Viewer builds its message from the strings and the app that logged the event, which isn't in the file, so Filepeek shows the strings themselves.
Windows XP event log
.evt
Format
- MIME type
- application/octet-stream
- Made by
- Microsoft
- Released
- 1993
Inside the file
- Holds
- Events, a record each
- Each event
- Time, type, source, ID and strings
- Layout
- A ring, the oldest written over
- Made by
- Windows NT to Server 2003
Opens in every browser
Filepeek reads EVT logs in Chrome, Edge, Firefox and Safari, on any computer or phone. On their own, browsers only download them.
- YouChromeOpens through Filepeek
- YouEdgeOpens through Filepeek
- YouFirefoxOpens through Filepeek
- YouSafariOpens through Filepeek
Apps that open EVT
- WindowsEvent Viewer, with Open Saved Log
- MacNo app built in opens it
- iPhone and iPadNo app opens it
- AndroidNo app opens it
Questions
How do I open an old .evt file without Windows XP?
Drop it on this page or choose Peek an EVT. Every event shows as a row, on any computer or phone.
Why don't I see the message Event Viewer shows?
Event Viewer puts an event's strings into a message the app that logged it keeps, on the computer that logged it. The log keeps only the strings, so Filepeek shows those, with the event's source, ID and type.
Where did Windows XP keep its logs?
In C:\Windows\System32\config: AppEvent.Evt for apps, SysEvent.Evt for the system and SecEvent.Evt for security.
Can it read a log copied while Windows was running?
Yes. Filepeek finds every record even when Windows hadn't brought the header up to date, and says so in the log's details.