asked on

Read partly corrupted Event Logfile

Hi, my RAID array failed for an unknown reason: https://www.experts-exchange.com/questions/21126972/Partition-recovery-RAID-0.html

I have been able to partly recover the 3 event log files, they are partly corrupted, contain some unencrypted text but is also encrypted or something by the event viewer.

I know that if I load them into the Windows 2000 event viewer it will just tell me that the files are corrupted... So how can I read these files?

I'm hoping they will give me a clue to why my array failed...

ASKER CERTIFIED SOLUTION

sirbounty

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Occupied

ASKER

Eldump was unable to do anything, it gave me the message that the logfile was corrupted, I'm guessing it used the Windows driver to look at the file because it gave me the error message in Swedish... (my system is Swedish..)

PsLogList gave me the same error message as ElDump...

Dumpel did not seem to have any option to read from a local file...

sirbounty

Hmm - let me take a look at your original question...brb.

sirbounty

So how were you able to recover the evt files? I can't see the image from here (blocked by company proxy).
Doesn't sound good to me though. Have you tried restorer 2000 by chance?
( http:Q_21014635.html#11240391)

Only other thing I could think is maybe a rom-based log? Not familiar with your system - so not sure if that's even an option -but if psloglist won't view it, I don't know what will. Sorry my friend.
Best of luck to you!

Occupied

ASKER

Since my other harddrive in the RAID array lost it's data I have the odd chunks of 32kb from the event viewer files (the even parts was of course on the other harddrive...)... Hence the corruption..

My system is just a desktop computer, the logfile was only saved on the harddrives...

Occupied

ASKER

If no one is able to help me with this how do I close this question? (I'm new to EE...)

sirbounty

Since I'm the only respondant, I can delete/refund if you like.
For future reference:
See http:help.jsp#hs5

Occupied

ASKER

To have it deleted would be a waste, I'm rewarding you the points because those applications might become useful to me in the future and you took the time to try any answer my question.