top of page

Windows Event Logs

Event logs are saved by Windows in order to record certain actions taken by the operating system, or software on the system.

In Windows 7 you should see these files saved to this location:


These can be viewed simply by typing in 'Event Viewer' at Start and opening the Event Viewer application.

You'll see that it provides a summary of administrative events and recently viewed nodes. If you click on the Event Viewer (Local) icon in the pane on the left, a drop down menu will open. Go to Window Logs . . . Application and you should a number of recorded events indicating the time when the computer was in use. Here for the sake of security I have redacted the viewable events except for one. Note that its Event ID is 6000, which indicates that there was unsuccessful login attempt. See the note here:

By making reference to the event IDs, you find out a lot about actions taken on a PC.

Windows 7 and other Win OSes older than Windows 2003 have event logs saved with the extension, .evtx, whereas earlier Windows systems had event logs saved with the extension, .evt.

bottom of page