Event Tracing for Windows (ETW)

Event Tracing for Windows (ETW) is the high-performance tracing framework built into the Windows kernel. It has three roles: providers (drivers, services and applications) emit events; controllers start and stop trace sessions and decide which providers are enabled; consumers read events in real time or from trace files.

Much of what investigators call "logging" rides on ETW. The channels you open in Event Viewer are delivered by ETW providers and written by the Event Log service to EVTX files. Other sessions write binary .etl files instead, often as circular buffers; persistent sessions configured to start at boot are defined under HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger. These Event Trace Logs can hold details that never reach the classic logs.

On a live system, logman query -ets lists the running trace sessions, and Get-WinEvent -Path <file>.etl -Oldest can read many .etl files. Every event is identified by its provider and an event ID, so always interpret the two together.

ETW is also a target. Endpoint security products consume ETW providers for telemetry, and attackers have disabled providers, removed Autologger configuration or patched ETW functions inside their own process to blind those tools. Missing or suddenly silent providers are therefore worth treating as possible anti-forensics rather than a lack of activity.