System crash need to get Event Viewer from system.

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Hi, I am trying to recover data for a client. He said that he saw in the
Event Viewer Security volations. He did not save the viewer as a log file,
but did not clear them either. Is there some kind of database or file name
that I could get off the harddrive? He really whats this info to show the
police.
 
John,

ERD Commander by Winternals comes to mind.

It will boot a non working XP system with functionality such as event
viewer.

-L
 
Back
Top