none
Viewing a corrupt security event log

    General discussion

  • I don't need help fixing the event viewer. I need help opening a saved security event log that was corrupt. I need to be able to review the log. Does anyone have any ideas how I can do this? I receive a, "The data is invalid" error message when attempting to open the SecEvent.Evt file.

    J. Swann – Information Security Engineer

    Friday, September 28, 2012 6:32 PM

All replies

  • Friday, September 28, 2012 8:03 PM
  • Thanks, I did see that. I couldn't get beyond step 1. My log did not return any results for the hex value in mentioned.


    J. Swann – Information Security Engineer


    • Edited by J. Swann Friday, September 28, 2012 8:13 PM
    Friday, September 28, 2012 8:12 PM
  • Hi,


    Please check if PsLogList can help you.


    Please also note that you may need administrator privileges to read the Security event log.


    Hope this helps.


    Jeremy Wu

    TechNet Community Support

    Monday, October 1, 2012 6:30 PM
    Moderator
  • No mas. That utility is only helpful for healthy logs. When I attempted to run it against the corrupt log file it simply stated:

    SecEvent.Evt:
    Could not open SecEvent.Evt event log on <hostname>:
    The event log file is corrupted.


    J. Swann – Information Security Engineer

    Tuesday, October 9, 2012 6:28 PM
  • Hi,


    Thanks for reply.


    However, I’m afraid that there is no workaround to read the log file due to it is corrupted.


    Thanks for your understanding.


    Jeremy Wu

    TechNet Community Support

    Wednesday, October 17, 2012 9:05 AM
    Moderator