Export corrupts Windows Event Log files

This blog post explains that exporting Windows Event Log (.evtx) files via Microsoft tools (wevtutil / Event Viewer) rewrites record headers and mistakenly shifts header timestamps (each header gets the timestamp of the following record, and the last header is set to zero), producing mismatches between header and record-content timestamps that can lead to incorrect forensic conclusions; investigators are advised to verify the source of event logs and cross-check header and content timestamps when analyzing exported logs.