Windows Event Logs


Event logs are saved by Windows in order to record certain actions taken by the operating system, or software on the system.

In Windows 7 you should see these files saved to this location:

C:\Windows\System32\winevt\Logs

These can be viewed simply by typing in 'Event Viewer' at Start and opening the Event Viewer application.

You'll see that it provides a summary of administrative events and recently viewed nodes. If you click on the Event Viewer (Local) icon in the pane on the left, a drop down menu will open. Go to Window Logs . . . Application and you should a number of recorded events indicating the time when the computer was in use. Here for the sake of security I have redacted the viewable events except for one. Note that its Event ID is 6000, which indicates that there was unsuccessful login attempt. See the note here: https://technet.microsoft.com/en-us/library/cc734033(v=ws.10).aspx

By making reference to the event IDs, you find out a lot about actions taken on a PC.

Windows 7 and other Win OSes older than Windows 2003 have event logs saved with the extension, .evtx, whereas earlier Windows systems had event logs saved with the extension, .evt.


Contact Me With Your Litigation Support Questions:

seankevinoshea@hotmail.com

  • Twitter Long Shadow

© 2015 by Sean O'Shea . Proudly created with Wix.com