Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Barrie Codona, BSc (Hons) Network Computing, 2007
7 Conclusions and Future Work
7.1 Conclusions
This dissertation looked at the problems that exist with the Windows event log. It had
been found that digital forensic investigators use the Windows event log to create a
timeline of events of what has happened on a computer system. Unfortunately the
Windows event log can easily be changed to conceal or remove key pieces of
information. Even within a server based environment, where the event logging servers
may be kept under lock and key they are still susceptible to abuse, as someone within
the company will have the key to the server.
It was pointed out that the time stamping of the events can be unreliable, so a central
time stamping system needs to be used. It has also been suggested that the logs should
be stored off site and by a company in a ‘write once read many’ environment and that
they would not give physical access to the servers, and that the data on these servers
contains a checksum to help validate the integrity of the logs and finally the logs
should also be encrypted before they are sent to the log file storage company.
An investigation into the weaknesses of the Windows event log found that it lacked
any form of security, and that it was possible to make changes to the data contained
within it. Times, dates, usernames and computer names could all be easily changed.
However, all of the changes involved having access to the event log files. It had been
discovered that .NET has a class, the FileSystemWatcher, that watches the file system
to see if any files have been modified. This was used in the application that was
developed. After the application was developed, it was thoroughly tested and based
upon these preliminary tests it was modified to improve its performance and
functionality. More tests were then carried out, the results of which were compared
the results to the preliminary tests. It had been found that using synchronous
encryption was 800% faster than asynchronous encryption. And that a good strong
key used for producing an HMAC hash would be hard to break.
68