Analysis and Evaluation of the Windows Event Log - Bill Buchanan

NAPIER UNIVERSITY
SCHOOL OF COMPUTING
PROJECT DIARY
Student: Barrie Codona
Supervisor: Bill Buchanan
Date: 26 th October 2007 Last diary date: 19 th October 2007
Objectives:
1. Investigate previous court cases that have made use of the event log.
2. Investigate ‘event numbers’ to further understand what they relate to.
3. Investigate the log to try and define start and end points for each entry, and then translate the hex
data to what is displayed to the user.
4. Attempt to replace the event log with one supplied from a donor pc.
5. Modify the ‘client logon id’ to try and change the computer name and user name.
6. Modify the 32 bit hex date and note the results.
Progress:
1. Tracked down the transcript from the Dr Harold Shipman case and a reference that describes what
he did and why he did it.
2. Found various sources describing the Event ID’s
3. Work In Progress
4. Successfully managed to copy the security log from the donor pc. This produced some interesting
results.
5. Altering the Client Logon ID has no effect on the Username that was used when the record was
created, more investigation needs to be done here.
6. Successfully managed to alter the 32 bit time & date stamp in the security log.
Supervisor’s Comments:
Version 2
Napier University