windows server 2008 r2 ( Default Event logs)folder accidently deleted. How to restore ?


  • Hi All,

    In our windows server 2008 r2, Default  event log folder (C:\Windows\System32\winevt\Logs) was accidently deleted by one system admin. How to recover the deleted folder. Kindly support

    Thursday, June 21, 2018 8:40 AM

All replies

  • Hi!

    If you have Shadow Copies is enabled and active on this partition then you can do the following:

    1) Right-click the folder you wish to restore (or a parent folder), click Properties and then go to Previous versions.

    2) Select your date, then click Copy.

    3) Specify a destination.

    4) You can now examine the restored file.

    If you don't have shadow copies enabled on the C drive, then the only option left in Windows is if the item is still in the Recycle Bin.  If it is not in the Recycle Bin it is highly unlikely it can be recovered without the use of a third party utility for that purpose.

    Best regards,

    Blog:  LinkedIn:   

    Thursday, June 21, 2018 9:06 AM