Corrupt application event log file

Boot to the secondary copy of NT and delete the. Your email address will not be published. Learn about the latest security threats, system optimization tricks, and the hottest new technologies in the industry. Over 1,, fellow IT Pros are already on-board, don't be left out! TechGenix reaches millions of IT Professionals every month, and has set the standard for providing free technical content through its growing family of websites, empowering them with the answers and tools that are needed to set up, configure, maintain and enhance their networks.

It may have already be uninstalled. I'm at my wits end. I'm a writer and I can't access my work because I can't use OpenOffice. The only applications that work are my internet applications thank Heaven and iTunes go figure. Please, please help. I don't know what else to do.

But you may have to do a refresh of your operating system if you have corrupted system files that can't be fixed. Was this reply helpful? Yes No. Sorry this didn't help. The four fields four 4-byte fields of metadata in the floating footer are, respectively, the offset to oldest record, the offset to next record, the record number of next record, and the record number of oldest record.

These same four fields are present in the event log file header, starting at byte offset 16, but are not kept in real time. They are only updated or synchronized with the real time data from the floating footer when the event log service terminates normally or when you use event viewer to "save log file as".

Furthermore a byte status field byte offset 36 of header will be an odd value when the file is open or was not closed properly, typically 0x09, 0x0B and so forth with any odd value serving the purpose. When closed properly and these four fields are synched, this file status byte will be even, typically 0x08 or 0x00 any even value is valid.

If the file was not properly closed, the four fields will not have been synched and the file status byte will be odd. When you attempt to open such a file with any viewer reliant upon the event log API, it will be reported as corrupt. This frequently occurs in forensics when you pull the plug or do a live acquisition.

EnCase doesn't rely upon that API and will parse them without repair. If you wish to use them in a viewer reliant upon the event log API, you'll need to repair the header. To repair the event log file, you simply need to copy the four fields from the floating footer into their corresponding location in the header and then set the file status byte to any even value.

Save and you are done. It's really that simple. The changes you are making are only to the header metadata. You are in no way changing data in any event log record. Document your steps in your report so that you can show what you did and why. Step 1: Open the corrupted file in your favorite hex viewer.

Winhex is used in this example. Locate the floating footer. Search for: 0x The floating header actually begins at 0x, which immediately precedes the above string. The floating header terminates with the same hex value, which is 0x These values also serve to define the size of the floating header in bytes evaluate as 32 little endian integer , which is 40 bytes.

The sixteen bytes byte offsets relative to object that follow the last "4" in the above string are the four 4-byte fields offset to oldest record, offset to next record, record number of next record, and record number of oldest record.

Office Office Exchange Server. Not an IT pro? Learn More. Windows Server TechCenter. Sign in. United States English. Ask a question. Quick access. Search related threads. Remove From My Forums. Asked by:.