At 12:10 PM 04/04/2011, Jamie Furtner wrote:
On 2011-04-04 8:37 AM, Thane Sherrington wrote:
I've got a computer with a corrupted Windows on it, and I'd like to
read the event logs. Anyway I can copy those to another PC and
read them? I can access the HD in PE.
T
They're stored as .evtx or .evt files in
C:\Windows\System32\winevt\Logs (On Vista and newer) and
C:\windows\system32\eventlogs (IIRC on Win2003 and older).
You should be able to grab them and open the saved logs in Event Viewer.
I forgot to get back to you on this. It worked perfectly, thanks a lot!
T
