Recover deleted Windows "Audit Logs"

[johan at johans.dk (Johan Peder Møller)]

Make a disk image if you are in any doubt. Then you can find the
relevant data afterwards. There are a lot of live cd's out there to
help you get the job done.

Ecsa
Johan M?ller

On Tuesday, November 3, 2009, Grymoire <pauldotcom at grymoire.com> wrote:
> > I'd like to know is it possible to recover deleted "Audit Logs" after being
> > erased by some administrator?
>
> First thing to do is to halt the computer before the disk blocks are
> overwritten.
>
> There are data recovery programs that restore deleted files. ?But be
> aware that using the computer increases the chance that the files
> will be unrecoverable. Booting up on a rescue disk is recommended.
>
> I've used "undelete" on Linux.
> _______________________________________________
> Pauldotcom mailing list
> Pauldotcom at mail.pauldotcom.com
> http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
> Main Web Site: http://pauldotcom.com