Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

If an installation of windows is unbootable, is it possible to access the event log from a Linux LiveCD?

share|improve this question

1 Answer 1

up vote 5 down vote accepted

It is possible if you are running Vista or newer. The event log data is now written to an XML file in %SystemRoot%\System32\winevt\Logs\.

Previous versions of Windows wrote the log in an undocumented binary format. This web page tries to describe that format.

GrokEVT which is mentioned on that page, is is a collection of scripts built for reading Windows NT/2000/XP/2003 event log files. GrokEVT is released under the GNU GPL, and is implemented in Python.

The default locations of the logs are:

  • %SystemRoot%\System32\Config\SysEvent.Evt (System Log)
  • %SystemRoot%\System32\Config\AppEvent.Evt (Application log)
  • %SystemRoot%\System32\Config\SecEvent.Evt (Security Log)
share|improve this answer
    
Where is this XML file stored? –  Macha Nov 29 '09 at 13:55
    
Windows 7/Vista XML event files stored in: %SystemRoot%\System32\winevt\Logs\ –  Umber Ferrule Jun 30 '10 at 16:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.