invalid XML file output about libevtx HOT 3 CLOSED

When you ask for xml output (-f xml) the output is not valid xml because

This is not the goal of the program to have a valid full XML document. The goal of the -f xml option is to provide output that is comparable to windows event log viewer xml output. You can easily write a small program around the library or Python binding to accomplish this if you need to.

Wrt 'recovered' entries - the xml was just not valid e.g., missing end tag ()

Not sure what you mean.

from libevtx.

Another question, in the xml i see the following (in vim):
%%1537^M
%%1538^M
%%1539^M
%%7168^M
%%7169^M
%%7170^M
%%7171^M
%%7172^M
%%7173^M

Why the extra carriage return? The characters can be removed ­ so they
really are there.
Or is this what is in the evtx bXML? Some list separator syntax? I don¹t
have a good C IDE environment to debug this; obviously i can simply remove
all carriage returns ­ but they only show up for the AccessMask data values.

TIA,
-jay

from libevtx.

As indicated this is to match the Windows event viewer output.

Or is this what is in the evtx bXML?

Yes

from libevtx.