0

On 8th April 8:30 PM my PC (Sony VAIO Laptop, Windows 10, 64x) faced some problem and it turned itself off. The screen suddenly just hung and within few seconds it turned off (without proper shutdown or any BSOD)

Half an hour later I turn on the PC, everything is fine after a slow startup, however what I failed to notice was that the system's time had changed.

I started backing up my data and kept to basic operations only (no WiFi, Bluetooth or any external devices)

After 11 hours (9 April, 7:30AM), when the backup was completed, I thought I'd inspect the problem. So I opened up event viewer to see the logs, but it was then that I noticed that the system time has gone one day back, and system time was 8th April 6:45 AM rightnow, and it would not show me any logs after 8 April 6:45 AM.

The logs I require are those of 8 April 8:30 PM, but the system thinks that time has not occurred yet!

I manually set the correct time, hoping records would show up, if any, but they didn't.

I'm sure the reason my PC crashed was due to faulty driver or hardware, because this has happened multiple times recently. I have just not identified the cause yet.

How can I get back the missing logs?

  • 1
    As long as the event log service was working, those log entries should still be there under the wrong time. The default view shows events in the reverse order they were written, not necessarily by the timestamp. The missing events should be located before the time changed. You will see events jump from being logged on the 8th to the 9th. – CConard96 Apr 9 '17 at 3:03
  • @CConard96 So logs would still be shown if the timestamp was in the future wrt system time? But I can't find any. No filters used when searching logs. – Vijay Chavda Apr 9 '17 at 3:25
  • They should be... otherwise people could dodge auditing and security logging just by changing the system time. Like I said though, they wouldn't be in order of the timestamp. You can click the time column to sort by timestamp. – CConard96 Apr 9 '17 at 3:40
  • @CConard96 Yeah, I believe that you're right.. it wouldn't be based on Timestamp. But I've obviously tried sorting and searching, there are no logs! – Vijay Chavda Apr 9 '17 at 3:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.