Use dump_chunk_slack.py and EVTXtract in tandem to reconstruct records from EVTX slack spaces.