Restore event viewer from system state backup
Posted on 2008-06-10
I need to view some auditing logs from the security section of my event viewer. The current event log was overwritten before the day I need to review. I'm wondering if I can pull the event viewer from last weekend's backup through Backup Exec11d to view last weeks events. The Saturday Full backup is set to include System State (Registry, System Files, SYSVOL, etc).
The file I need is "C:\WINDOWS\system32\config\SecEvent.Evt"
Can I pull the event viewer out of that backup? I don't want to restore the complete registry or system files to overwrite the current system. I only need to view the event viewer as it was on Saturday. If this is possible, please advise.