Windows Event Log
From Just Solve the File Format Problem
(Difference between revisions)
Dan Tobias (Talk | contribs) (→Vista, Windows 2008, and Windows 7) |
Dan Tobias (Talk | contribs) m |
||
| Line 10: | Line 10: | ||
These systems use the .evt extension and are usually found in the C:\Windows\system32\config directory. | These systems use the .evt extension and are usually found in the C:\Windows\system32\config directory. | ||
| − | * [http://www.forensicswiki.org/wiki/Windows_Event_Log_%28EVT%29 | + | * [http://www.forensicswiki.org/wiki/Windows_Event_Log_%28EVT%29 Forensics Wiki: Windows Event Log (EVT)] |
* [http://support.microsoft.com/kb/308427 How to view and manage event logs in Event Viewer in Windows XP] | * [http://support.microsoft.com/kb/308427 How to view and manage event logs in Event Viewer in Windows XP] | ||
Revision as of 16:04, 25 October 2013
The Windows Event Log tracks things that happen to Windows systems for diagnostic use. Its format, and the built-in Windows utilities to access it, has varied between Windows versions. Generally there are three different logs, Application, System, and Security.
Windows 2000, XP and 2003
These systems use the .evt extension and are usually found in the C:\Windows\system32\config directory.
- Forensics Wiki: Windows Event Log (EVT)
- How to view and manage event logs in Event Viewer in Windows XP
Vista, Windows 2008, and Windows 7
These files are also usually in the C:\Windows\system32\config directory, but have .log, .log1, and .log2 extensions... or no extension at all. Attempting to open them in a general file-viewer program seems to hang Windows Explorer.
