Jeff,
THe corrupt message you aqre getting is commonly caused by a hard shutdown or
making an image of a machine that is currently running. There are several bytes
that are changed when the Event logging service starts and stops in Windows.
You can use the EnCase Windows Syslog Parser script to read and export the logs
to HTML or Excel...
Or if you like a hex editor, you can repair them manually..
Here are simple instructions or repairing a "corrupted" (reportedly corrupted)
event log....
This works with all three common Event logs (app, sec, sys)
Copy out the event log and use your favorite hex editor:
1. Do search for \x11\x11\x11\x11\x22\x22\x22\x22
2. Skip 20 from the beginning of the found text (\x11\x11...etc)
3. Copy the next 8 bytes and paste at the begining of the file, starting at
offset 20
4. Goto offset 36 and change value to "8"
5. Save the file
6. Open with Windows Event Viewer (eventvwr.exe)
Hope that helps...
-lance-
-----Original Message-----
From: Jeff Bryner [mailto:jbryner1@yahoo.com]
Sent: Fri 1/7/2005 10:14 AM
To: forensics@securityfocus.com
Cc:
Subject: Workarounds for Windows Event File corruption
I'm working on a case where I'd like to get time stamp info out of a
windows application event log (AppEvent.evt).
If I copy the file to another windows box and open it via event viewer
I get the dreaded message about the file being corrupted.
Web searches all lead to support articles suggesting deletion of the
file to recover..obvioulsy not my solution.
I can strings -el the file and get the descriptions of the events but I
*really* want the time stamp associated with the entries.
I've tried hex editing the file manually to match the header/footer to
what I'm seeing in other working event log files, but I haven't found
the right combination yet.
Ideally I'd like to be able to open it on another windows box and
capture screen prints of the events.
Any clues from this group?
Thanks,
Jeff.
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
Note: The information contained in this message may be privileged and
confidential and thus protected from disclosure. If the reader of this
message is not the intended recipient, or an employee or agent responsible
for delivering this message to the intended recipient, you are hereby
notified that any dissemination, distribution or copying of this
communication is strictly prohibited. If you have received this
communication in error, please notify us immediately by replying to the
message and deleting it from your computer. Thank you.
-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com
