SYSTEM AND METHOD FOR RECOVERY OF DAMAGED EVENT LOG FILES

摘要

The present invention relates to a technology on a system and a method for restoring a Windows XML event log (EVTX) file used for an event log system after Windows Vista of operating systems (OSs) provided by the Microsoft corporation when the EVTX file is damaged. The system for restoring a damaged event log file comprises: a searching unit for collecting a header of the EVTX file, a chunk, and an event record from a storage; a verifying unit for inspecting integrity of the header of the EVTX file, the chunk, and the event record collected in the searching unit; and a file restoring unit for restoring the EVTX file by combining a composition inspected by the verifying unit.