Which one of the following is true of evtx logs$?$

Which one of the following is true of evtx logs$?$

They can be extracted with the $--$save$-$evtx option of evtlogs plugin

They require additional post$-$Volatility processesing

They are represented as memory$-$mapped files

They are stored in a new body format

None of the above