up vote 2 down vote favorite
share [g+] share [fb]

If an installation of windows is unbootable, is it possible to access the event log from a Linux LiveCD?

link|improve this question
89% accept rate
feedback

1 Answer

up vote 4 down vote accepted

In theory it is possible.... If you are running vista or Windows 7. The event log data is now written to a XML file...

For the binary format, this web page, covers the structure of the file... http://www.whitehats.ca/main/members/Malik/malik%5Feventlogs/malik%5Feventlogs.html

The first link on the page, http://www.sentinelchicken.org/projects/grokevt/ , is an opensource event log reader...

The default locations of the logs are:

%SystemRoot%\System32\Config\SysEvent.Evt (System Log) %SystemRoot%\System32\Config\AppEvent.Evt (Application log) %SystemRoot%\System32\Config\SecEvent.Evt (Security Log)

link|improve this answer
Where is this XML file stored? – Macha Nov 29 '09 at 13:55
Windows 7/Vista XML event files stored in: %SystemRoot%\System32\winevt\Logs\ – Umber Ferrule Jun 30 '10 at 16:57
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.