Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
5.3.5 Saving To Disk
Figure 30 shows the code that is used to write the Event Message to disk, firstly it
tries to open the file to add text to it, and if it is unsuccessful it creates a new file and
then adds the plain text XML string to it.
// Create an new instance of a textwriter called ‘tsw’.
TextWriter tsw;
// Attempt to open the log file to add text, if it fails then create
// a new one.
try
{
tsw = File.AppendText("C:\\EvtLog2.log");
}
catch
{
tsw = new StreamWriter(@"C:\\EvtLog2.log");
}
// Write the decrypted message to file.
tsw.WriteLine(decryptedMessage);
// Close the file.
tsw.Close();
5.4 Event Log Reader
Figure 30: Saving Event Data to Disk
This application will be used to be able to read the contents of the log file that has
been created, it will allow the user to be able to read through the entries in the Event
Log file one at a time, similar to a flat database. The Log Reader will also perform the
authentication of the Event Log data, for this to be achieved the user will be required
to enter the exact same key that was used to generate the original HMAC value. Based
upon the key that was entered, an HMAC value will be generated on the same
information as the original checksum, as long as the data and key are the same as the
original values, when these are compared they should produce the same HMAC value.
5.4.1 Opening File
Figure 31 shows the code that was used to read the Event Log file from the disk, it
does this line by line. At the same time it copies the information from the line that it
has just read to an array, it then moves onto the next line in the file and repeats the
process. One point to note is that there is also a check in here to ensure that only the
lines in the log file that start with ‘’ are copied to the array. This is done
47