Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

If an installation of windows is unbootable, is it possible to access the event log from a Linux LiveCD?

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

In theory it is possible.... If you are running vista or Windows 7. The event log data is now written to a XML file...

For the binary format, this web page, covers the structure of the file... http://www.whitehats.ca/main/members/Malik/malik_eventlogs/malik_eventlogs.html

The first link on the page, http://projects.sentinelchicken.org/grokevt/, is an opensource event log reader...

The default locations of the logs are:

%SystemRoot%\System32\Config\SysEvent.Evt (System Log) %SystemRoot%\System32\Config\AppEvent.Evt (Application log) %SystemRoot%\System32\Config\SecEvent.Evt (Security Log)

share|improve this answer
Where is this XML file stored? –  Macha Nov 29 '09 at 13:55
Windows 7/Vista XML event files stored in: %SystemRoot%\System32\winevt\Logs\ –  Umber Ferrule Jun 30 '10 at 16:57
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.