Retrieve c:\windows\system32\winevt\security\log\archive-security-*****.evtx

[somesekhar]

Hello ,

While trying to retrieve archive-security log from path c:\windows\system32\winevt\security\log , I couldn't see any the files in the restored path. It is restoring the folder structure but final log folder is empty.
I tried to "show hidden files" option but without success. in the restore gui it is showing retrieve successful with few byte (i suppose these are for restoring the folder structure ).
Can someone share experience , of how to do it ? or if there is something I missed in my procedure ?

thanks in Advance !

 

[marclant]

It's because it's part of the SystemState backup and not the filesystem backup.

Check this: http://www.tsmblog.org/step-by-step...cked-up-systemstate-to-an-alternate-location/