EVTXtract recovers and reconstructs fragments of EVTX log files from raw binary data, including unallocated space and memory images.