Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
A centralised log server brings with it many advantages, Westphal (2001) points out
some of these advantages, centralised management of log files, maximised disk space
usage, easier access for auditing purposes and a more secure method of retention. As
well, adding encryption and check summing on top of a remote logging server adds
yet another layer of security on these log files, which is always an advantage. The
problem with this solution is that the data is venerable while it is travelling along the
network to the log repository. Dario Forte, of Milan University, explains:
“Log file integrity can be violated in several ways. An attacker might
take advantage of a non-encrypted transmission channel between the
acquisition and destination points to intercept and modify the transiting
log. He might also spoof the IP sending the logs, making the log
machine think it is receiving log entries and files that actually come
from a different source.” Forte (2005).
The general consensus is that a centralised log management system should be used to
store, not only Windows event logs, but all the logs that are generated by all the
devices on the network, and that this log server should be connected to an
authentication server.
Alles (2004) have identified that a major problem is corporate fraud that is due to
deliberate fraud between managers as this poses the greatest challenge to any audit
system, there really is not any point in the best encryption and the best authentication
servers if a corrupt manager can walk into the room where the logging server is being
stored and gain access to the hard drive. So they recommend a black-box log file,
something that is similar to a flight data recorder that you would find in an aeroplane
and that the black box needs to be kept offsite and away from anyone that may want
to gain access to it.
2.5 Conclusions
This chapter has presented some of the techniques that forensic investigators are
currently using to reconstruct a timeline of events using event logs. It has also
highlighted some of the methods that are used to defeat such a forensic investigation.
Finally it has highlighted some of the ways in which audit logs are currently being
19