Windows Log Forensics

In Issue 16 of the free (IN)SECURE magazine Rob Faber describes the design and the various features of Microsoft Windows event logging services. His article covers both, the old log of the NT family of kernels and the redesigned event logging services found in Vista and Windows Server 2008.

By Andreas Schuster at 04/24/2008, 04:00 PM |

Security Event ID Cheat Sheet

Do you know the meaning of all the different event ID codes in the security event log of Microsoft Windows NT, 2000, XP and 2003? The Digital Forensics Institute provides you with a cheat sheet of all the codes and their meaning. (via e-evidence.info)

(more...)

By Andreas Schuster at 08/03/2007, 05:00 PM |

Finally...

A blog post by Harlan Carvey made me aware of some official documentation of the Event Log Header and EOF structures.

(more...)

By Andreas Schuster at 06/15/2007, 07:10 PM |

Weird IE7 Event Log

Bill Tydeman reported a new event log on the Windows Forensic Analysis group at Yahoo! and on his new blog. The weird thing is, this log seemingly is not properly configured and the log file is garbled.

(more...)

By Andreas Schuster at 05/15/2007, 04:00 PM |

GrokEVT Version 0.4.0

GrokEVT is a set of Python scripts for reading Windows Event Log files (.evt) on Unix hosts. New in version 0.4.0 is grokevt-findlogs which carves event records from raw binary data like unallocated clusters or a memory dump.

By Andreas Schuster at 04/09/2007, 04:00 PM |

A Common Misconception

An article in a German computer magazine recently remined me of a common misconception in event log parsers. Most parsers treat Windows event log files as sequential files - and read them from top to bottom. While this usually works, it might mangle or suppress a single log entry under special circumstances.

(more...)

By Andreas Schuster at 02/16/2007, 02:25 PM |

Reconstruction of Corrupted Event Logs

Viewing a saved Windows Event Log file on a different system might be unexpectedly difficult. The Event Log Service might refuse to open the file as it appears to be corrupted. In that situation a procedure documented by Stepahn Bunting may provide first aid.

(more...)

By Andreas Schuster at 12/21/2006, 05:00 PM |

Default ACL of Event Logs

Eric Fitz took the trouble to search the Windows sources for default access control lists of the various event logs. He posted his findings for Windows 2000, XP with Service Pack 2 and Windows Server 2003 in the Windows Auditing Team's blog.

By Andreas Schuster at 03/05/2006, 04:10 PM |