Checkout a new tool: EVTXtract (https://github.com/williballenthin/EVTXtract) that helps recover event log records from unallocated space.