Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
The data Archiving System listens for a connection using port 13000, after a
connection has been established it generates a random RSA key pair, one public and
one private key. The public key is sent to the client machine and the private key is
kept and used for decrypting all the data that is sent to it. The data received is then
saved to disk. It continues this process until the client application disconnects, Figure
14 shows this.
Listen for connections on port 13000
If client connects
{
Generate new RSA key pair
Send public key to client
While Client is still connected
{
Listen for messages
Decrypt Message with private key
Time stamp incoming message
Write message to file
}
}
Figure 14: Server side pseudo code
4.6.3 Event Viewer Pseudo Code
Figure 15 shows the pseudo code for the event viewer, initially it reads the contents of
the event log into an array as a complete XML string. It then extracts the information
from the XML string as it needs it. Based up the HMAC key that has been entered by
the user, it also calculates what the HMAC value should be for that particular XML
string and informs the user if it matches the HMAC signature that is contained within
the XML string.
Read Event Log File into Array
Extract data from XML tags and populate fields
If user clicks ‘next’ or ‘previous’
{
Display next or previous event accordingly
Calculate checksum based on inputted key
}
Figure 15: Event viewer pseudo code
37