Does anyone know if a hard drive format is recorded in the Event Viewer and if so what to search for? I tried searching for “format” but almost every event in there has that word in the description. I have a client that claims the drive just ended up empty and they refuse to believe they did anything to it. I have fully scanned the system and there is no signs of malware.
