Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
system would also provide an attacker with the opportunity of removing the hard disc
drives and either manipulating the data using another machine or simply destroying
the drives. All of these evidence tampering techniques would make the digital
investigation much harder and a more time consuming process.
1.2 Background
From as far back as the 1970’s computer professionals have identified the need for
computer security in distributed systems that contain sensitive information; part of the
security package that is built into operating systems is the ability to audit events that
have occured on a computer system. For the Windows user, this consists of the
Windows event log which is a customisable audit log. It was originally designed as a
diagnostic tool to identify any problems with the operating system and it also allows
the user some degree of control over what type of events are recorded. In a
commercial environment the auditing will be defined as part of the company’s
security policy. This will involve recording of events, via the use of domain
controllers, when users are successfully logging on and off, and which host machines
they are using. Although the domain controllers are used to capture the event data it is
also possible to setup and store the log files on a separate log server. This server could
be protected from network based attacks by using a firewall which only allows traffic
from the domain controllers, see Figure 1.
Figure 1: Log server protected by a firewall
However, as previously mentioned, there are a number of flaws with the Windows
event logging service. These flaws not only relate to the security of the information
after it has been written to disc, but also to what information it is actually capturing,
storing and how it is stored.
10