Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
Figure 4: Replacing the Windows security log.
Server B successfully managed to accept the transplanted Security Event Log from
Server A without producing any errors. This shows that it is possible to conceal
events that have happened by simply copying a file to replace the original.
Experiment 4 - Modify the ‘logon ID’. This experiment used a Hex Editor called
‘Hex Workshop’ called (http://www.hexworkshop.com) to view and modify the
contents of the Security Log file. The data contained within the log file was in a fairly
readable format, it is 8 bit ASCII that has been padded out to 16 bit. Thus the word
‘Hello’ is represented in the file as ‘H.e.l.l.o.’.
First to be modified was the username, this was changed to a different one with the
same number of characters in it, and then the computer name was modified, once
again keeping the number of characters the same. When the event service was
restarted it successfully showed that the both the username and computer name had
successfully been modified.
This is highly significant as it shows that data contained within the event log can be
modified and these changes will be accepted by the system. Furthermore, it also
shows that it is possible for a perpetrator to either conceal their tracks or frame
someone else.
Experiment 5 - How the event log stores the time. This experiment involved the use
of a Hex Editor to analyse the content of the Security Event Log. Trial and error was
used to locate the bits that held the date and time stamp, the Hex Editor used has a
25