Recover deleted Windows "Audit Logs"

[pauldotcom at grymoire.com (Grymoire)]

> I'd like to know is it possible to recover deleted "Audit Logs" after being
> erased by some administrator?

First thing to do is to halt the computer before the disk blocks are
overwritten.

There are data recovery programs that restore deleted files.  But be
aware that using the computer increases the chance that the files
will be unrecoverable. Booting up on a rescue disk is recommended.

I've used "undelete" on Linux.