Add support for getting localized strings from sidecar .mta files exported by windows event viewer

src/evtx_parser.rs

@@ -224,6 +224,7 @@ impl ParserSettings {
         self
     }
 
+
     pub fn validate_checksums(mut self, validate_checksums: bool) -> Self {
         self.validate_checksums = validate_checksums;
 
@@ -252,6 +253,7 @@ impl ParserSettings {
         self.wevt_cache.as_ref()
     }
 
+
     pub fn should_separate_json_attributes(&self) -> bool {
         self.separate_json_attributes
     }

src/evtx_record.rs

@@ -29,13 +29,13 @@ pub struct EvtxRecord<'a> {
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct EvtxRecordHeader {
     pub data_size: u32,
-    pub event_record_id: RecordId,
+    pub event_record_id: RecordId, // Not same as EventRecordId in payload
     pub timestamp: Timestamp,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct SerializedEvtxRecord<T> {
-    pub event_record_id: RecordId,
+    pub event_record_id: RecordId, // Not same as EventRecordId in payload
     pub timestamp: Timestamp,
     pub data: T,
 }
@@ -273,3 +273,4 @@ impl<'a> EvtxRecord<'a> {
         Ok(out)
     }
 }
+

src/lib.rs

@@ -11,10 +11,12 @@ pub use evtx_file_header::{EvtxFileHeader, HeaderFlags};
 pub use evtx_parser::{EvtxParser, IntoIterChunks, IterChunks, ParserSettings};
 pub use evtx_record::{EvtxRecord, EvtxRecordHeader, RecordId, SerializedEvtxRecord};
 pub use utils::utf16::{Utf16LeDecodeError, Utf16LeSlice};
+pub use mta::{MtaError, MtaFile, MtaResult};
 
 pub mod binxml;
 pub mod err;
 pub mod model;
+pub mod mta;
 
 // Optional: PE resource parsing to extract WEVT_TEMPLATE blobs (see issue #103).
 #[cfg(feature = "wevt_templates")]