Windows Server 2003 Event Logs

[ServerMachine]

Recently someone hacked into my Windows 2003 Server and messed around
with the active directory. It was all recorded in the event viewer
logs. However when I came to look at them, it said that the security
log file was corrupt. This may have been caused by the hacker. The log
file is around 18MB. Is their any way to extract the information so
that this person can be prosecuted.

Thank You

 

[Steven L Umbach]

You could send the log file to a data recovery specialists who would
charge you a ton of money with no guarantees. Even if you got the data you
want it is very doubtful that you could actually be able to track down the
person and prosecute them, and you would need a whole lot more than a log
file - law enforcement has much bigger fish to fry, and your losses would
have to be proveable and substantial. It would make more sense to
concentrate on how this happened [most valuable use of your event log] and
implement measures to reduce the risk of another malicious event in the
future. When someone breaks into someone's house around here, the police
take a report and tell you to "get better locks". --- Steve