Is there any way to undo after clearing a log on Windows 2008 server?

Question

I accidentally cleared a event log. Is there any way I can get it back?

So Windows server 2008 backs up all the events from the past somewhere? — Duk, Aug 22 '12 at 17:29
@Duk: No, *you* back up your important data. If you don't, it's not important data by definition. — Sven, Aug 22 '12 at 17:31

score 8 · Accepted Answer · answered Aug 22 '12 at 17:30

They are gone, unless you either:

Saved the logs as it suggested you do when you clicked clear
Have a full system backup

It's also possible but unlikely data recovery software could undelete them. They are stored in C:\Windows\System32\winevt\Logs if you want to use software like GetDataBack or similar to try to recover them.

score 1 · Answer 2 · answered Aug 22 '12 at 17:35

Typically the event logs are stored in C:\Windows\System32\winevt\Logs. As ErkiA eludes to, restoring from backup maybe your only option. This is assuming you do a full system backup with somehthing like Backup Exec.

The only other saving grace is if you have Volume Shadow Copy on your Primary Drive. But still, this requires some source which you are actively backing up.

Is there any way to undo after clearing a log on Windows 2008 server?

2 Answers2