python-evtx is a pure Python module for accessing Microsoft EVTX files. http://www.williballenthin.com/evtx/index.html #DFIR