EVTXtract recovers and reconstructs fragments of EVTX log files from raw binary data, including unallocated space and memory images. - View it on GitHub