title: ERROR_FILE_NOT_FOUND unexpectedly returned for OpenBackupEventLog function
body: <p>I'm trying to open an .evtx file on a Windows 7 x64 machine using the <a href="http://msdn.microsoft.com/en-us/library/aa363671%28v=VS.85%29.aspx" rel="nofollow">OpenBackupEventLog</a> function however I keep on getting <a href="http://msdn.microsoft.com/en-us/library/windows/desktop/ms681382%28v=vs.85%29.aspx" rel="nofollow">ERROR_FILE_NOT_FOUND</a> (error code 2) even though the file <strong>does</strong> exist.</p>
  
  <p>My P/Invoke declaration / point where I call the file is:</p>
  
  <pre><code>[DllImport("advapi32.dll", SetLastError = true, ExactSpelling = false, EntryPoint = "OpenBackupEventLog")]
  public static extern IntPtr OpenBackupEventLog(
      [MarshalAs(UnmanagedType.LPTStr)]string uncServerName,
      [MarshalAs(UnmanagedType.LPTStr)]string fileName);
  
  IntPtr ptr = NativeMethods.OpenBackupEventLog(null, filename);
  if (ptr == IntPtr.Zero &amp;&amp; File.Exists(filename))
  {
      // This exception is thrown and so the file does exist
      throw new Win32Exception(string.Format("Failed to open event log archive '{0}'", filename));
  }
  </code></pre>
  
  <p>Note that this is inside an x86 process.</p>
  
  <p>The only thing that I can think of is that the problem is down to Unicode / ANSI marshalling (previously I recall getting <code>ERROR_INVALID_PARAMETER</code> instead), however I've double checked and playing around with the marshalling has no effect.</p>
  
  <p>Why is this failing to open the file / how can I diagnose this?</p>