# ETL

## Overview

**Evidence:** ETL\
**Description:** Collect ETL Log\
**Category:** System\
**Platform:** windows\
**Short Name:** etl\
**Is Parsed:** No\
**Sent to Investigation Hub:** Yes\
**Collect File(s):** Yes

## Background

Event Trace for Windows (ETW) is a high-performance event tracing mechanism built into Windows. ETL (Event Trace Log) files store trace data captured by ETW providers. These files contain detailed system and application event information that can be more granular than standard Windows Event Logs.

ETL files are used for diagnostics, performance analysis, and troubleshooting. They can contain valuable forensic information about system behavior, application activity, and performance metrics.

## Data Collected

This collector gathers structured data about etl.

### ETL Data

| Field        | Description               | Example                                    |
| ------------ | ------------------------- | ------------------------------------------ |
| `Name`       | Artifact name             | ETL Log                                    |
| `Type`       | File or Folder            | File                                       |
| `SourcePath` | Original file path        | C:\Windows\System32\WDI\LogFiles\trace.etl |
| `Path`       | Relative path in evidence | Other/trace.etl                            |

## Collection Method

This collector collects ETL files from the following locations:

* `Windows\System32\WDI\LogFiles\*.etl`
* `Windows\System32\LogFiles\WMI\*.etl`
* `Windows\System32\WDI\*\*\*.etl`
* `Programdata\Microsoft\Windows\Power Efficiency Diagnostics` (directory)
* `Windows\Panther\*.etl`
* `Users\*\AppData\Local\Microsoft\Windows\Explorer\*.etl`

## Forensic Value

ETL logs provide detailed diagnostic and performance data that can reveal system behavior and application activity. Investigators use this data to analyze system performance issues, track application behavior, investigate diagnostic events, detect anomalous system activity, and reconstruct detailed system timelines.