Analysis and Evaluation of the Windows Event Log - Bill Buchanan

CO42019 – Project 4
These modifiactions were then saved to disc and directory snoop was refreshed, this then
showed that the data on the drive had been modified, however when the event viewer was
opened up it did not show any changes. This must mean that it does not read from the
file after it has loaded up.
The system was then restarted.
Directory Snoop was opened up and pointed towards the SecEvent.Evt file, this showed
that the time and date had been set back to their original value. This was varified with
opening up the event viewer.
Perhaps it only stores ‘new events’ in memory. That is events that have happened after
the system was started.
So once again the Hex editor was used to modify the time and date of ‘old events’ and
this was verified as being changed on the hard drive using directory snoop.
The system was then restarted.
A quick look with the event viewer shows that the times of the events have been set back
to their original value.
System Starts
Event Service opens log
file into memory
Event Service monitors
and updates memory
with new events
Is system
shutting
down
No
Yes
Event Service writes
memory to file
System Stops
Project – Week 5.doc Page 8 of 8