Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
Ryan Harris of Purdue University (2006) proposes that anti-forensic attacks are
grouped into the four categories, each of these are then subdivided into both physical
and digital groups. The categories that he suggests are evidence destruction, evidence
hiding, evidence source elimination and evidence counterfeiting.
• Evidence Destruction. Destroying evidence according to Harris (2006)
partially or completely obliterates the evidence thus rendering it useless to a
forensic investigation. One of the techniques that can be used to do this is
called zero-footprinting. These are techniques that seek to eliminate all
residual traces of an attack in order to prevent computer forensic operators
from obtaining any results (Forte, 2007).
• Evidence Hiding. Ryan Harris (2006) states that hiding evidence is the act of
removing evidence from view so that it is less likely to be incorporated into
the forensic process. The evidence is not destroyed or manipulated however; it
is just made less visible to the investigator. This can be achieved by using
techniques like steganography or cryptography. Kessler (2004) describes
steganography as the art of covered, or hidden, writing. Its purpose is hide
information from a third party. Cryptography on the other hand is the art of
secret writing; it differs from steganography because it does not hide the fact
that a secret communication is taking place between two parties.
• Evidence Source Elimination. Disabling the Windows event log or any
auditing system would help to hinder an investigation as data about the
activities would never have be recorded; Harris (2006) writes “There is no
need to destroy evidence since it is never created”. This could be similar to a
burglar wearing gloves so that he does not leave any finger prints at the scene
of the crime. This forward planning of shutting off an auditing system would
imply that there had been some degree of planning involved.
• Evidence Counterfeiting. This involves changing the data that is contained
within the event log, either the timestamps, usernames and/or machine names.
At the kernel level it could also involve changing the Modified Accessed
Created and Entry modified (MACE) attributes of a file. Evidence
counterfeiting is the act of creating a faked version of the evidence which is
designed to appear to be something else (Harris, 2006).
16