Execution
Event Trace Logs (ETL files)
ETL files cheat sheet: what ETW trace logs are, forensically useful .etl files (WDI boot traces, Wifi.etl, DiagTrack), collection, tracerpt and etl-parser.
- Location
- C:\Windows\System32\LogFiles\WMI\*.etl
- Proves
- Low-level system activity (boot processes, Wi-Fi connections, updates) recorded by ETW sessions
- Timestamps
- Per-event raw clock (QPC, system time or CPU cycles) converted to FILETIME, UTC; header start/end times; .etl NTFS times
- Retention
- Most system .etl files are circular and overwrite old events at max size; boot and shutdown traces keep only the latest cycle
- Access
- Administrator; files of running sessions may be locked: copy from a shadow copy if a plain copy fails
- Evidence of
- ExecutionNetwork & remote access
- Type
- File / file system
- Windows
- Vista / 78 / 8.11011
- KAPE target
- EventTraceLogsWindowsUpdate
- Velociraptor
- Windows.Triage.Targets:EventTraceLogsWindowsUpdate
Tools
Compare all tools- tracerptCLI · built into Windows
- Windows Performance AnalyzerGUI
- etl-parserCLI · open source
- Get-WinEventCLI · built into Windows
- PerfViewGUI · open source
What it is
Event Tracing for Windows (ETW) is the kernel-level tracing framework behind most Windows logging. Providers (the kernel, network stack, services, applications) emit events into trace sessions. A session can feed a real-time consumer, such as the Event Log service or an EDR, or write its buffers to a binary Event Trace Log (.etl) file.
Windows ships with many sessions that write .etl files for diagnostics, performance and telemetry. Most are circular and short-lived, but some record activity that no EVTX log keeps: boot-time process and file activity, Wi-Fi connections, update and download history. They are an overlooked supplement to event logs, not a replacement.
Location
| File or folder | Content reported by researchers | Notes |
|---|---|---|
C:\Windows\System32\LogFiles\WMI\ | AutoLogger session files, such as Wifi.etl (SSID, adapter, BSS type, encryption of wireless connections) | Many files are circular |
C:\Windows\System32\WDI\LogFiles\ | BootCKCL.etl, ShutdownCKCL.etl: circular kernel context logs covering boot and shutdown (file I/O, DLL loads, disk reads) | Overwritten at each boot / shutdown |
C:\ProgramData\Microsoft\Windows\Power Efficiency Diagnostics\energy-ntkl.etl | Disk, PnP and external device information from power diagnostics | Written when diagnostics run |
C:\Users\<user>\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog*.etl | Explorer start-up activity, including shell items and Run key data | Per user |
C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-Diagtrack-Listener.etl | DiagTrack telemetry; FortiGuard found process-execution traces of deleted malware in it | Population is inconsistent across builds |
C:\Windows\Logs\WindowsUpdate\*.etl (Windows 10+) | Windows Update client activity | Converted with Get-WindowsUpdateLog |
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\*.etl | Delivery Optimization download activity | Read with Get-DeliveryOptimizationLog |
C:\Windows\System32\SleepStudy\ | Sleep and power transition traces on modern-standby devices |
Ad-hoc traces also end up as .etl: netsh trace captures (NetTrace.etl), Windows Performance Recorder output, and tool-specific logs.
What it proves
- Depends on the provider. Examples: a wireless network the host connected to (
Wifi.etl), processes and files touched during a boot (BootCKCL.etl), updates and downloads (Windows Update, Delivery Optimization). - A session file shows that the provider was enabled and logging at the time covered by the file.
- It does not give continuous history: circular files cover a short window, and many providers log nothing of forensic interest. Treat findings as corroboration.
Key fields
| Field | Meaning |
|---|---|
| Header: logger name, start and end time, boot time, clock type, buffer size | Describes the session and how to convert timestamps |
| Provider GUID / name | Which component produced the event |
| Event ID, version, opcode, task | Identify the event type within a provider (manifest-based events) |
| Process ID / thread ID | Context of the process that logged the event |
| Payload | Provider-specific data (paths, SSIDs, URLs, error codes) |
| Lost events / buffers | Indicates dropped data when the session could not keep up |
Timestamps
| Timestamp | Set when | Format | Pitfalls |
|---|---|---|---|
| Event timestamp | Event written to the session buffer | Raw counter (QPC, system time or CPU cycles, per the header's clock type) converted to FILETIME UTC by parsers | Wrong conversion if the header is damaged; tools may display local time |
| Header start / end time | Session started / file closed | FILETIME, UTC | A circular file's start time predates its oldest surviving event |
.etl file $SI times | File created / last flushed | NTFS, UTC | AutoLogger files are recreated or rewritten at boot |
Retention and clearing
- Most system
.etlfiles are circular: when the maximum size is reached, old events are overwritten and cannot be recovered from the file. - Boot and shutdown traces are replaced at each boot or shutdown, so only the latest cycle survives (older copies may exist in volume shadow copies).
- Sessions are configured under
HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger; an attacker with admin rights can stop sessions or disable providers, which is itself an anti-forensic signal. - Deleting
.etlfiles needs admin rights for system folders; look for deletions in the USN journal.
Collection
- KAPE target:
EventTraceLogs(WDI,LogFiles\WMI, SleepStudy,energy-ntkl.etl, Delivery Optimization logs) andWindowsUpdate(Windows Update.etl). Neither coversExplorerStartupLog*.etlin user profiles nor the DiagTrack AutoLogger folder; collect those explicitly. - Velociraptor (
Windows.Triage.Targets):EventTraceLogs,WindowsUpdate. For live ETW (not files),Windows.ETW.*artifacts subscribe to providers in real time. - Built-in: files of running sessions may be locked; copy them from a shadow copy if a plain copy fails.
logman query -etslists the sessions running at collection time.
logman query -ets
robocopy C:\Windows\System32\LogFiles\WMI E:\case\ETL\WMI *.etl /COPY:DAT
robocopy C:\ProgramData\Microsoft\Diagnosis\ETLLogs E:\case\ETL\Diagnosis /E /COPY:DAT
tracerpt E:\case\ETL\WMI\Wifi.etl -o E:\case\Wifi.xml -of XML
Get-WinEvent -Path E:\case\ETL\WMI\Wifi.etl -Oldest | Select-Object -First 20
Parsing tools
- tracerpt (built into Windows): converts
.etlto XML or CSV plus a summary report. - Get-WinEvent (PowerShell): reads
.etlfiles when-Oldestis used. - Windows Performance Analyzer (Windows ADK, free): graphical analysis of kernel traces such as
BootCKCL.etl. - PerfView (Microsoft, open source): opens and exports ETL traces.
- etl-parser (Airbus CERT, open source, Python): parses manifest-based, TraceLogging and kernel MOF events on any OS;
etl2xmlandetl2pcap(fornetsh tracecaptures). WPP events are not yet supported. - Get-WindowsUpdateLog and Get-DeliveryOptimizationLog (built-in cmdlets): decode those specific trace logs.
Investigation tips
- Collect ETL folders by default in a triage collection; they are small and often the only record of boot-time or wireless activity.
- Parse
Wifi.etlalongside network profiles and SRUM to place the host on a specific wireless network. - Use
BootCKCL.etlto look for early-boot binaries and drivers that ran before the Event Log service started. - WPP-based traces need the provider's format files (TMF), which are usually not public, so many files will only yield partial output.
- Convert parsed events to a common time zone and merge them into a super timeline instead of reviewing them in isolation.
- Absent or tiny ETL files on a system that normally writes them can indicate disabled AutoLogger sessions; check the
Autologgerregistry key.
Related artifacts
- Windows event logs (EVTX)Windows event log cheat sheet: EVTX locations, must-know event IDs for logons, processes, services and log clearing, retention, audit policy and parsing tools.
- Network profiles (NetworkList)NetworkList cheat sheet: network profiles, SSIDs, gateway MAC addresses, first and last connection times (local time), WLAN profile files and WLAN events.
- SRUM (System Resource Usage Monitor)SRUM cheat sheet: SRUDB.dat tables and GUIDs, per-app network bytes and CPU time, hourly UTC records, 30 to 60 day retention and ESE repair steps.
- USN Journal ($UsnJrnl:$J)USN journal cheat sheet: $UsnJrnl:$J and $Max, record fields, reason flags, parent references, default size, rollover, fsutil and MFTECmd parsing.
- Volume Shadow Copies (VSS)Volume Shadow Copies cheat sheet: store files in System Volume Information, copy-on-write blocks, deletion by ransomware, mounting and parsing.
- Prefetch Files (.pf)Windows Prefetch cheat sheet: .pf location per version, run count, the last eight run times, referenced files, retention limits and how to parse.
- Sysmon Event LogSysmon cheat sheet: Operational log location, key event IDs, ProcessGuid and hash correlation, config in the registry, tampering signs and parsing tools.
Glossary terms
- Event Tracing for Windows (ETW)The kernel-level tracing framework in which providers emit events to sessions; it feeds the event logs, .etl files and security tools.
- Windows event IDThe number identifying an event type within a given provider; it only has meaning when paired with its provider and log channel.
- Super timelineA single chronological view merging timestamps from the file system, registry, event logs and other artifacts, typically built with Plaso.
- Triage collectionTargeted acquisition of high-value artifacts (hives, event logs, $MFT, Prefetch) instead of a full disk image, using KAPE or Velociraptor.