Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
2 Literature Review
2.1 Introduction
The aim of this literature review is to present to the reader current techniques and
research that is being utilised and developed in the Log Management field, and how
Digital Forensics are used to analyse these log files. It will also take a look at some of
the techniques that are being used to disrupt a forensic investigation.
By identifying these techniques, it is intended that this will have an influence on the
design of the system that is to be developed with the aim of improving the overall
security and credibility of the Windows Event Logging system.
2.2 Digital Forensics
Crimes involving computers have increased dramatically over the last 10 years. This
is due to the cost of owning a computer and having an internet connection decreasing,
therefore more people are buying computers and more people are subsequently using
the internet to facilitate their crimes. The Parliamentary Office of Science and
Technology (Postnote, 2006) define some types of computer crime as storing illegal
images, copyright violations, phishing, denial of service attacks and creating viruses.
In similarity to the physical world, when a crime is committed there is always some
form of evidence left behind, this is where digital forensics comes in.
Digital forensics is the science of being able to extract digital evidence from
computers and other electronic devices “to aid the legal process” (Brown, 2006).
According to Rogers (2005) of Purdue University, this is achieved by “identification,
collection, examination and analysis” of the data that is contained on storage devices
with the aim of discovering incriminating digital information (Nair, 2006).
This section presents to the reader some of the techniques that are currently used
during such an investigation and how the Windows event log would be used to assist
an investigation by recreating a timeline of events.
13