Analysis and Evaluation of the Windows Event Log - Bill Buchanan

More documents

Recommendations

Info

Barrie Codona, BSc (Hons) Network Computing, 2007 Event Logger Data Archiver HMAC Key Prompt User for HMAC Key Accept Client Connection Connect to Server Generate RSA Key Pair Receive from Server Send To Client Event Type Capture Events Receive Cipher Text Host ID HMAC Check XML Decrypt Cipher Text Private Key Public Key Encrypt Plain Text XML Server Timestamp Send Cipher Text Write to File Figure 7: Event Logger Schematics 4.3 Event Logging One flaw of the Windows Event Log is that it does not keep track of which users are accessing which data files and to see if they have been modified by that user. This 31
Barrie Codona, BSc (Hons) Network Computing, 2007 presents a problem that should also be addressed by the design of the software for this report. Instead of just monitoring the Event Log files, which are only accessed by the system when the server is started or stopped, it is proposed that the software being developed should be able to either monitor the entire system or specific directories. The performance of the system could be compromised by an excessively large amount files to keep track of, however, the more data that is produced then a more accurate investigation can be performed. The .NET Framework provides the ‘FileSystemWatcher’ class which is able to monitor if files have been accessed, modified, deleted or renamed, MSDN (2008). It can be set to monitor specific files within a specified directory or the entire system. Making this event driven will also make the program more efficient as far as processing is concerned. As previously discussed in the Literature Review chapter, the formatting of the data that is contained within the log file is important. Firstly, for digital forensic purposes, the data that is captured and stored needs to be done in a manner that does not alter the original data. Secondly, the data should be in a format that is easily accessible to a variety of different applications. Based upon these specifications the data that is being stored will be contained within the XML format. This essentially places every piece of information within its own opening and closing tags. For example, Barrie. The information that will be captured will consist of: • The time and date that the event took place. • The user that performed the action. • What kind of action has been performed. • And the path of the file. 4.4 Data Archiving System To achieve the black-box concept, this will involve a client-server architecture, where the client is the machine that is capturing the events and the server or Data Archiving System will be the machine that is storing the log files. 32
Page 1 and 2: Analysis and Evaluation of the Wind
Page 3 and 4: Barrie Codona, BSc (Hons) Network C
Page 31: Barrie Codona, BSc (Hons) Network C
Page 75 and 76: Appendix A: Diary Sheets
Page 77 and 78: NAPIER UNIVERSITY SCHOOL OF COMPUTI
Page 83 and 84:
NAPIER UNIVERSITY SCHOOL OF COMPUTI
Page 85 and 86:
Appendix B: Preliminary Gantt Chart
Page 87 and 88:
Nov '07 Dec '07 Jan '08 Feb '08 Mar
Page 89 and 90:
C:\Documents and Settings\Barrie\My
Page 91 and 92:
Page 93 and 94:
Page 95 and 96:
Appendix D: Server Application Code
Page 97 and 98:
Page 99 and 100:
Appendix E: Event Viewer Code
Page 101 and 102:
Page 103 and 104:
Page 105 and 106:
Appendix G: Processor Monitor Code
Page 107 and 108:
Appendix H: HMAC Brute Force Cracke
Page 109 and 110:
Page 111 and 112:
Page 113 and 114:
Appendix I: Windows Event Log Tests
Page 115 and 116:
Copy Security Log C:\windows\system
Page 117 and 118:
Another look at the Security Log re
Page 119 and 120:
The Event Service is then restarted
Page 121 and 122:
Another look at the ‘c:\windows\s
Page 123 and 124:
CO42019 - Project 4 Computer Name P
Page 125 and 126:
CO42019 - Project 4 Turned off the
Page 127 and 128:
CO42019 - Project 4 And then restar
Page 129 and 130:
CO42019 - Project 4 Modify the ‘l
Page 131 and 132:
CO42019 - Project 4 Project - Week
Page 133 and 134:
Page 135 and 136:
Page 137 and 138:
CO42019 - Project 4 As previously d
Page 139 and 140:
CO42019 - Project 4 The screenshot
Page 141 and 142:
CO42019 - Project 4 Displaying the
Page 143 and 144:
CO42019 - Project 4 Modifying the r
Page 145 and 146:
CO42019 - Project 4 Master File Tab
Page 147 and 148:
CO42019 - Project 4 Modify the sect
Page 149 and 150:
CO42019 - Project 4 Sectors 3748520
Page 151 and 152:
CO42019 - Project 4 This now shows
show all

Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Create successful ePaper yourself

Delete template?

Save as template?