Worked on documentation.

documentation/Windows XML Event Log (EVTX).asciidoc

@@ -34,7 +34,7 @@ files.
 == License
 
 ....
-Copyright (C) 2011-2021, Joachim Metz <[email protected]>.
+Copyright (C) 2011-2023, Joachim Metz <[email protected]>.
 Permission is granted to copy, distribute and/or modify this document under the
 terms of the GNU Free Documentation License, Version 1.3 or any later version
 published by the Free Software Foundation; with no Invariant Sections, no
@@ -73,6 +73,7 @@ April 2012 | Additional information.
 | 0.0.20 | J.B. Metz | May 2021 | Textual and formatting changes.
 | 0.0.21 | J.B. Metz | Octoboer 2021 | Additional information regarding format versions.
 | 0.0.22 | J.B. Metz | December 2021 | Additional information about MUI language neutral file.
+| 0.0.23 | J.B. Metz | December 2023 | Updated references.
 |===
 
 :numbered:
@@ -873,7 +874,7 @@ Stored in little-endian
 | 0x12 | SysTimeType | System time (128-bit) +
 Stored in little-endian
 | 0x13 | SidType | NT Security Identifier (SID) +
-See `[NTSID]`
+See `[LIBFWNT]`
 | 0x14 | HexInt32Type | 32-bit integer hexadecimal +
 32-bit (unsigned) integer that should be represented in hexadecimal notation
 | 0x15 | HexInt64Type | 64-bit integer hexadecimal +
@@ -1241,7 +1242,7 @@ The information stored in this resource is used to:
 * determine the string identifiers of channels, keywords, levels, opcodes and tasks
 * parse Event XML "UserData"
 
-For more detailed information see: `[LIBEXE]`.
+For more detailed information see: `[LIBEXE]` and `[LIBFWEVT]`;
 
 ===== Message string identifier
 
@@ -2044,8 +2045,6 @@ Messages        : [u'ksproxy.ax']
 [appendix]
 == References
 
-`[CHAPPEL08]`
-
 [cols="1,5",options="header"]
 |===
 | Title | The Shell Core Provider
@@ -2064,6 +2063,16 @@ Messages        : [u'ksproxy.ax']
 | URL | https://github.com/libyal/libexe/blob/master/documentation/Executable%20(EXE)%20file%20format.asciidoc
 |===
 
+`[LIBFWEVT]`
+
+[cols="1,5",options="header"]
+|===
+| Title | Windows Event manifest binary format
+| Author(s) | J.B. Metz
+| Date | October 2011
+| URL | https://github.com/libyal/libfwevt/blob/main/documentation/Windows%20Event%20manifest%20binary%20format.asciidoc
+|===
+
 `[MS-EVEN6]`
 
 [cols="1,5",options="header"]
@@ -2077,39 +2086,53 @@ Messages        : [u'ksproxy.ax']
 [cols="1,5",options="header"]
 |===
 | Title | BinXml
-| URL | http://msdn.microsoft.com/en-us/library/cc231334(v=prot.10).aspx +
-http://msdn.microsoft.com/en-us/library/cc231337(v=prot.10).aspx +
-http://msdn.microsoft.com/en-us/library/cc231339(v=prot.10).aspx +
-http://msdn.microsoft.com/en-us/library/aa382793%28v=VS.85%29.aspx +
-http://msdn.microsoft.com/en-us/library/cc238875(v=prot.10).aspx
+| URL | https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-even6/e6fc7c72-b8c0-475b-aef7-25eaf1a64530
 |===
 
-`[NTSID]`
+[cols="1,5",options="header"]
+|===
+| Title | Array Types
+| URL | https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-even6/3e08eb46-ec3d-464c-9614-16af6e232fa9
+|===
 
 [cols="1,5",options="header"]
 |===
-| Tile | NT security descriptor definitions
-| URL | https://downloads.sourceforge.net/project/libpff/documentation/MAPI%20definitions/NT%20security%20descriptor.pdf
+| Title | LevelType Complex Type
+| URL | https://learn.microsoft.com/en-us/windows/win32/wes/eventmanifestschema-leveltype-complextype
 |===
 
-`[SCHUSTER07]`
+[cols="1,5",options="header"]
+|===
+| Title | Type System
+| URL | https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-even6/8aa98312-f199-4e37-a51f-d3a2ccb50d60
+|===
+
+[cols="1,5",options="header"]
+|===
+| Title | MS-PLA: Product Behavior
+| URL | https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pla/905cad7f-1a12-49b4-a263-461a2977ab71
+|===
+
+`[LIBFWNT]`
+
+[cols="1,5",options="header"]
+|===
+| Title: | Security Descriptor
+| URL: | https://github.com/libyal/libfwnt/blob/main/documentation/Security%20Descriptor.asciidoc
+|===
 
 [cols="1,5",options="header"]
 |===
 | Title | Introducing the Microsoft Vista Event Log File Format.
 | Author(s) | A. Schuster
 | Date | 2007
-| URL | http://www.dfrws.org/2007/proceedings/p65-schuster_pres.pdf
 |===
 
-`[SCHUSTER10]`
-
 [cols="1,5",options="header"]
 |===
 | Tittle | Linking Event Messages and Resource DLLs
 | Author(s) | A. Schuster
 | Date | October 5, 2010
-| URL | http://computer.forensikblog.de/en/2010/10/linking-event-messages-and-resource-dlls.html
 |===
 
 `[SCHUSTER11]`
@@ -2122,8 +2145,6 @@ http://msdn.microsoft.com/en-us/library/cc238875(v=prot.10).aspx
 | Date | February 6, 2011
 |===
 
-`[W3C]`
-
 [cols="1,5",options="header"]
 |===
 | Title | Extensible Markup Language (XML) 1.0 (Fifth Edition)