Windows Event Log

The Windows Event Log tracks things that happen to Windows systems for diagnostic use. Its format, and the built-in Windows utilities to access it, has varied between Windows versions. Generally there are three different logs, Application, System, and Security.

Windows 2000, XP and 2003
These systems use the .evt extension and are usually found in the C:\Windows\system32\config directory.


 * Forensics Wiki: Windows Event Log (EVT)
 * How to view and manage event logs in Event Viewer in Windows XP

Vista, Windows 2008, and Windows 7
These files are also usually in the C:\Windows\system32\config directory, but have .log, .log1, and .log2 extensions... or no extension at all. Attempting to open them in a general file-viewer program seems to hang Windows Explorer.


 * Forensics Wiki: Windows XML Event Log (EVTX)
 * Event Viewer (Vista)
 * Windows Event Log (MSDN)

Links

 * Wikipedia: Event Viewer