Difference between revisions of "Windows Event Log (EVT)"

From ForensicsWiki
Jump to: navigation, search
Line 5: Line 5:
  
  
Details of .evt file format can be found in Microsoft's MSDN library under 'EVENTLOGRECORD'
+
Details of .evt file format can be found in Microsoft's MSDN library under [http://msdn.microsoft.com/library/default.asp?url=/library/en-us/eventlog/base/eventlogrecord_str.asp EVENTLOGRECORD].
[http://msdn.microsoft.com/library/default.asp?url=/library/en-us/eventlog/base/eventlogrecord_str.asp EVENTLOGRECORD]
+

Revision as of 15:29, 13 March 2006

MS Windows Event Log Files


Windows typically maintains three event log files: application, system, and security. They are generally found in C:\Windows\system32\config.


Details of .evt file format can be found in Microsoft's MSDN library under EVENTLOGRECORD.