Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
Abstract
The windows event log is used in digital forensic cases, but unfortunately it is flawed
in many ways, and often cannot be seen as a verifiable method of determining events.
In the past few years there have been a few highly publicised cases where the data that
is contained within the event log is used to successfully secure a conviction. The aim
of this dissertation is to develop a solution that addresses the flaws in the Windows
event logging service. Through research carried out it had been found that it was
possible to disable the event log service. This then allowed for important data to be
modified, such as usernames, computer names, times and dates. It was also noted that
an event log from one machine could successfully be transplanted into another
without any problems. All of these vulnerabilities involved having access to, and
being able to edit, the event log files.
Based upon the research done, an event logging application was developed using C#
and the Microsoft .NET framework. It makes use of RSA and AES encryption and
HMAC hash signatures to improve the integrity of the data. The application is divided
up into three components, an event logger which monitors specific files and folders
within a computer system and sends alerts to the data archiving system in an XML
format, and an event viewer that presents the events in a readable format to the user.
The performances of the symmetric and asymmetric encryption were tested against
each other. It had been found that the symmetric encryption was 800% faster than
asymmetric encryption. Also the HMAC hash signatures were tested to see how long
it would take to do a brute force attack on them. It was discovered that approximately
21,093 keys were processed every second, this was then compared to the key entropy
and how a longer random key would be harder to break.
3