Recover Cleared Windows Event Viewer System Log

جميع الردود

• 

  

  1

  تسجيل الدخول للتصويت

  Check from C:\Windows\System32\winevt\Logs\System.evtx

  Else check .log, log1, log2 from 

  C:\Windows\System32\config
  

  • تم التحرير بواسطة Partha1012 12/شوال/1439 11:55 ص
  • تم الاقتراح كإجابة بواسطة Michael HxyMicrosoft contingent staff, Moderator 24/شوال/1439 02:54 م
  • تم وضع علامة كإجابة بواسطة Hamid Sadeghpour SalehMVP, Moderator 05/ربيع الثاني/1441 08:07 م

  12/شوال/1439 11:54 ص

  رد

  |

  اقتباس
• 

  

  0

  تسجيل الدخول للتصويت

  Unless you happen to have a backup they're gone.

   

   

  ---

  
  Regards, Dave Patrick ....
  Microsoft Certified Professional
  Microsoft MVP [Windows Server] Datacenter Management
  
  Disclaimer: This posting is provided "AS IS" with no warranties or guarantees, and confers no rights.
  

  • تم الاقتراح كإجابة بواسطة Dave PatrickMVP 24/شوال/1439 03:03 م

  12/شوال/1439 01:14 م

  رد

  |

  اقتباس
• 

  

  0

  تسجيل الدخول للتصويت

  Hi,

  Thanks for your question.

  If you ever saved the event  logs, you can find the logs in the system path (C:\Windows\System32\winevt\Logs\)

  Secondly, if there’s a system backup, you could try to restore from a previous system state to recover the logs.

  Hope this helps. If you have any question and concern, please feel free to let me know.

  Best regards,

  Michael

  ---

  Please remember to mark the replies as an answers if they help.
  If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

  • تم الاقتراح كإجابة بواسطة Michael HxyMicrosoft contingent staff, Moderator 24/شوال/1439 02:54 م

  13/شوال/1439 06:38 ص

  رد

  |

  اقتباس

  المشرف
• 

  

  0

  تسجيل الدخول للتصويت

  Hi,

  Just checking in to see if the information provided was helpful. Please let us know if you would like further assistance.

  Best Regards,

  Michael

  ---

  Please remember to mark the replies as an answers if they help.
  If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

  15/شوال/1439 09:12 ص

  رد

  |

  اقتباس

  المشرف
• 

  

  0

  تسجيل الدخول للتصويت

  Hi,

  Just want to confirm the current situations.

  Please feel free to let us know if you need further assistance.

  Best regards,

  Michael

  ---

  Please remember to mark the replies as an answers if they help.
  If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

  
  

  • تم التحرير بواسطة Michael HxyMicrosoft contingent staff, Moderator 18/شوال/1439 02:24 م

  18/شوال/1439 02:24 م

  رد

  |

  اقتباس

  المشرف
• 

  

  0

  تسجيل الدخول للتصويت

  Ctrl + Z literally worked for me in this same instance, just now...

  As long as you haven't taken many actions in Windows since then...

  • تم الاقتراح كإجابة بواسطة MorganThePerson 14/ذو الحجة/1440 03:08 م

  14/ذو الحجة/1440 03:07 م

  رد

  |

  اقتباس