Parsing carved evtx records using EvtxECmd

Thanks to EvtxECmd, now we get better handling of deleted event log records. The detail is here.