Event Viewer Deletion Time

Hi,

 I currently have a windows 2003 server and one day I needed to see who accesed it at a certain time but the logs appeared to have been deleted by someone. How do I see who deleted them or at least the time of deletion?

Regards!
parseroAsked:
Who is Participating?
 
ThorrssonCommented:
Slideshare on receovering Event log info
http://www.slideshare.net/ctin/recovering-information-from-deleted-security-event-logs-ctin

Here is a screenshot of the entry found after  clearing the log on a 2008 R2 box
 EVT Example
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.