Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
6.5 Experiment 2: Accuracy
This experiment will be used to check the accuracy of the application, to ensure that
all the events that are being generated are actually being captured by the application.
The tester application was slightly modified to allow for an event log file to be
modified, it now randomly modifies the ‘SecEvent.txt’ file. For the purpose of this
experiment a text file that is contained within a different directory to the data files,
that are being created, is used to represent the event log file. The directory structure is
represented by Figure 47.
Data Files
Event Log Files
Figure 47: Test directory structure
The tester application was set up to create 1,000 files and, at some random point
during this time, to modify the ‘SecEvent.txt’ file. Figure 48 shows in its display box
that the ‘File Counter’ is set to 1000 and that the ‘SecEvent.txt’ would be modified
after the 426 th file was created.
Figure 48: Tester application generating random event
59