Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
presents a problem that should also be addressed by the design of the software for this
report. Instead of just monitoring the Event Log files, which are only accessed by the
system when the server is started or stopped, it is proposed that the software being
developed should be able to either monitor the entire system or specific directories.
The performance of the system could be compromised by an excessively large amount
files to keep track of, however, the more data that is produced then a more accurate
investigation can be performed.
The .NET Framework provides the ‘FileSystemWatcher’ class which is able to
monitor if files have been accessed, modified, deleted or renamed, MSDN (2008). It
can be set to monitor specific files within a specified directory or the entire system.
Making this event driven will also make the program more efficient as far as
processing is concerned.
As previously discussed in the Literature Review chapter, the formatting of the data
that is contained within the log file is important. Firstly, for digital forensic purposes,
the data that is captured and stored needs to be done in a manner that does not alter
the original data. Secondly, the data should be in a format that is easily accessible to a
variety of different applications.
Based upon these specifications the data that is being stored will be contained within
the XML format. This essentially places every piece of information within its own
opening and closing tags. For example, Barrie. The information that
will be captured will consist of:
• The time and date that the event took place.
• The user that performed the action.
• What kind of action has been performed.
• And the path of the file.
4.4 Data Archiving System
To achieve the black-box concept, this will involve a client-server architecture, where
the client is the machine that is capturing the events and the server or Data Archiving
System will be the machine that is storing the log files.
32