Windows 10 How to parse/enumerate Event Viewer event properties/details.

[harrisonchu88]

I am attempting to save a copy of an inactive recovery partition located on my primary SSD as a .vhd to a peripheral HDD, so that I can delete the partition from my SSD.


Here is the DISKPART input I've attempted to use:

create vdisk file="m:\recovery\recovpart1.vhd" maximum=450 type=fixed sd="DA;;GA;;;WD)"


When sending the above, I get this error message echoed back to me:

DiskPart has encountered an error: The parameter is incorrect. See the System Event Log for more information.


As for the Event Viewer, I'm not able to understand any of the contents, as they seem to be obfuscated or just isn't human-readable as-is (to my eyes, at least). Below is a copy (with certain fields redacted for my privacy):

Log Name: System

Source: Virtual Disk Service

Date: REDACTED

Event ID: 3

Task Category: None

Level: Information

Keywords: Classic

User: N/A

Computer: REDACTED

Description:

Service started.

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">

<System>

<Provider Name="Virtual Disk Service" />

<EventID Qualifiers="16896">3</EventID>

<Version>0</Version>

<Level>4</Level>

<Task>0</Task>

<Opcode>0</Opcode>

<Keywords>0x80000000000000</Keywords>

<TimeCreated SystemTime="REDACTED" />

<EventRecordID>504</EventRecordID>

<Correlation />

<Execution ProcessID="0" ThreadID="0" />

<Channel>System</Channel>

<Computer>REDACTED</Computer>

<Security />

</System>

<EventData>

<Data>@2010005</Data>

</EventData>

</Event>

Continue reading...