tailing

[dkhokhlov]

Is it possible to tail evtx files? using custom ReadSeek?

[omerbenamram]

It's technically possible using seek as you've mentioned. It's not implemented however by evtx_dump.

[dkhokhlov]

it looks like chunks get reused. is it why evtx dumps records out of order?
will the tailing need to traverse whole file to get last record?