Neat script by @foxit to detect tampering of EVTX log files to hide individual records: https://github.com/fox-it/danderspritz-evtx