Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I accidentally cleared a event log. Is there any way I can get it back?

share|improve this question
Restore it from backup. – EEAA Aug 22 '12 at 17:25
So Windows server 2008 backs up all the events from the past somewhere? – Duk Aug 22 '12 at 17:29
@Duk: No, you back up your important data. If you don't, it's not important data by definition. – Sven Aug 22 '12 at 17:31
up vote 8 down vote accepted

They are gone, unless you either:

  • Saved the logs as it suggested you do when you clicked clear
  • Have a full system backup

It's also possible but unlikely data recovery software could undelete them. They are stored in C:\Windows\System32\winevt\Logs if you want to use software like GetDataBack or similar to try to recover them.

share|improve this answer

Typically the event logs are stored in C:\Windows\System32\winevt\Logs. As ErkiA eludes to, restoring from backup maybe your only option. This is assuming you do a full system backup with somehthing like Backup Exec.

The only other saving grace is if you have Volume Shadow Copy on your Primary Drive. But still, this requires some source which you are actively backing up.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.