Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
1 Introduction
1.1 Project Overview
The windows event log is used in digital forensic cases, but unfortunately it is flawed
in many ways, and often cannot be seen as a verifiable method of determining events.
In the past few years there have been a few highly publicised cases where the data that
is contained within the event log is used to successfully secure a conviction.
Dr Harold Shipman used a database program for storing information about his
patients. Whenever anything was added or modified in the database it automatically
filled in the time and date. Dr Shipman used his knowledge of computers to rollback
the system time and date so that he could enter false information about his patients
and their medical conditions after he had killed them. What Dr Shipman was unaware
of was that when the system time and date is altered it shows up in the Windows event
log. This information was successfully used in court to prove that he had falsified his
patient’s records after they had past away.
In America the collapse of Enron and WorldCom spurred the introduction of the
Sarbanes-Oxley Act in 2002, this piece of US legislation places greater focus on the
auditing process within an IT department. It expects that the IT staff will risk assess
the auditing process and introduce controls that increase the security and integrity of
this process. Although this piece of legislation only currently applies in America, the
UK’s Financial Services Authority is in the process of implementing a similar piece of
legislation here in the UK. It is currently being referred to as Europe-SOX or SOX-
Lite and, just like its American big brother, it too places greater emphasis on the
credibility of audit logs.
As previously mentioned these logs can be used in digital forensic cases to provide an
insight into what the computer system has been used for, when it has been used and
who was using it. Unfortunately the audit logs are not stored securely on the computer
system. Anyone that has administrative privileges can turn off the logging service.
They can subsequently edit the contents of the logs, delete the logs and they can
replace the entire log with one from another machine. Physical access to the computer
9