8

If an installation of windows is unbootable, is it possible to access the event log from a Linux LiveCD?

Improve this question

4 Answers 4

Reset to default
10

It is possible if you are running Vista or newer. The event log data is now written to an XML file in %SystemRoot%\System32\winevt\Logs\.

Previous versions of Windows wrote the log in an undocumented binary format. This web page tries to describe that format.

GrokEVT which is mentioned on that page, is is a collection of scripts built for reading Windows NT/2000/XP/2003 event log files. GrokEVT is released under the GNU GPL, and is implemented in Python.

The default locations of the logs are:

  • %SystemRoot%\System32\Config\SysEvent.Evt (System Log)
  • %SystemRoot%\System32\Config\AppEvent.Evt (Application log)
  • %SystemRoot%\System32\Config\SecEvent.Evt (Security Log)
Improve this answer
3
  • Where is this XML file stored?
    – Macha
    Nov 29, 2009 at 13:55
  • 1
    Windows 7/Vista XML event files stored in: %SystemRoot%\System32\winevt\Logs\
    – Umber Ferrule
    Jun 30, 2010 at 16:57
  • 2
    Vista and later use the EVTX format, not EVT. And the raw EVTX file is definitely not an xml file. Try opening it with any text editor and see
    – phuclv
    Jun 2, 2019 at 3:27
2
  1. Windows event logs are also files, but they are commonly locked by Windows (Event Log Service) and it is impossible to open these files on "live" system. But if the computer is started from another disk or the system drive from the analyzed machine is connected to another computer, you can read event logs as files. The default location of event logs on Vista/2008 and better is "C:\Windows\System32\winevt\Logs\".
  2. Try Event Log Explorer, it's free for personal use. It better than Event Viewer, e.g. it lets you read even damaged event files.
Improve this answer
1
  • Does this answer of yours really add something to the one that was accepted years ago already?
    – zagrimsan
    May 25, 2016 at 13:05
0

I have a situation where I have a pile of HDD that have been removed from various machines during upgrades. Not knowing what they came out of, accessing the system log in the location listed above, allowed me to access the domain name and user access of that drive.

%drive letter%:\Windows\System32\winevt\Logs

Improve this answer
1
  • 1
    This question was asked and answered in 2009 and you answered in 2016 after an answer was already accepted.
    – Eric F
    Apr 1, 2016 at 17:59
0

Yes it's possible. From a Debian or Ubuntu live CD, you can install evtxexport.

evtxexport is a utility to export items stored in a Windows XML EventViewer Log (EVTX) file

It is part of the "libevtx-utils" package.

apt install libevtx-utils

There are also other Perl or Python based tools like

  • EvtxParser "to convert Windows Event Log files to XML"
  • EVTX : "A cross-platform parser for the Windows XML EventLog format"
  • or python-evtx : "a pure Python parser for recent Windows Event Log files"
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.