where are windows event logs stored
Windows event logs are also files, but they are commonly locked by Windows (Event Log Service) and it is impossible to open these files on live system. But if the computer is started from another disk or the system drive from the analyzed machine is connected to another computer, you can read event logs as files. The default location of event logs on Vista/2008 and better is C:\Windows\System32\winevt\Logs\.