Invalid XML character about libevtx HOT 5 CLOSED

Thanks for your reply. Not sure if I can share the whole file. There only a few such events mostly from a long time ago However, I have since determined that it is the event file itself. i.e., the windows event viewer refuses to create XML for these events – so not sure what libevtx could do Here is the ‘raw text’ for one of them: (from windows event viewer) 4739001356900x80200000000000008530Security666666-WIN7VMLockout Policy666666-WIN7VMS-1-5-21-1424057555-4072980066-844447911S-1-5-18666666-WIN7VM$W0x3e7----0--- (I replaced some characters in the above text ) I am currently piping the output of evtxexport into a sax parser. I plan on wrapping the stream with my own class and just throwing away characters between 0 and 7. This gets me going. BTW – we tried using the native windows 64 build vs a Cygwin-based build. The native windows exe ran orders of magnitude slower (>5 minutes vs 30 seconds.) Any ideas? We figure it’s a buffering issue but don’t know where to begin to debug it.