We are trying to decode a .etl file and we need the wfp.tmf file. According to this:http://serverfault.com/questions/312305/where-is-wfp-tmf-for-windows-server-2008-r2 it is a "restricted" file. Does anyone know how I can get the 32-bit version of the file for a 32-bit Windows 7 installation? thanks! Jeff

Do you have access to a Vista 32-bit computer? If so, the file should be located in C:\Windows\System32 http://the.techy.dstro.com/ikelogs

Hi, In Windows 2008 R2 and Windows 7, you could displays trace messages from an event trace log file (.etl) via Tracefmt (Tracefmt.exe). You may refer the following article: http://msdn.microsoft.com/en-us/library/ff552974(v=VS.85).aspx Note The features of Tracefmt are included in TraceView. You can use TraceView to display trace messages from a log file or a real-time trace session in the TraceView dialog box or in a Command Prompt window. TraceView is included in the \tools\tracing subdirectory of the Windows Driver Kit (WDK). Windows Driver Kit Version 7.1.0 downloading: http://www.microsoft.com/download/en/details.aspx?id=11800 Hope that helpsPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.