huh, thats neat. EVTX files occasionally have interesting data in their chunk slack space. Added script to dump: https://github.com/williballenthin/python-evtx/blob/master/scripts/dump_chunk_slack.py