Analysis and Evaluation of the Windows Event Log - Bill Buchanan

More documents

Recommendations

Info

NAPIER UNIVERSITY SCHOOL OF COMPUTING PROJECT DIARY Student: Barrie Codona Supervisor: Bill Buchanan Date: 26 th October 2007 Last diary date: 19 th October 2007 Objectives: 1. Investigate previous court cases that have made use of the event log. 2. Investigate ‘event numbers’ to further understand what they relate to. 3. Investigate the log to try and define start and end points for each entry, and then translate the hex data to what is displayed to the user. 4. Attempt to replace the event log with one supplied from a donor pc. 5. Modify the ‘client logon id’ to try and change the computer name and user name. 6. Modify the 32 bit hex date and note the results. Progress: 1. Tracked down the transcript from the Dr Harold Shipman case and a reference that describes what he did and why he did it. 2. Found various sources describing the Event ID’s 3. Work In Progress 4. Successfully managed to copy the security log from the donor pc. This produced some interesting results. 5. Altering the Client Logon ID has no effect on the Username that was used when the record was created, more investigation needs to be done here. 6. Successfully managed to alter the 32 bit time & date stamp in the security log. Supervisor’s Comments: Version 2 Napier University
NAPIER UNIVERSITY SCHOOL OF COMPUTING PROJECT DIARY Student: Barrie Codona Supervisor: Bill Buchanan Date: 2 nd November 2007 Last diary date: 26 th October 2007 Objectives: 1. Further investigation into how the event log stores the time & date. 2. Automate the function of copying a ‘modified’ log file. 3. Further investigation into Dr Harold Shipman. 4. Begin investigation into current and previous research (literature review). Progress: 1. It was discovered that the time is a count of the number of seconds that have passed since 00:00:00 01/01/1970 2. A console application has been developed that will prevent the event service from starting after the computer has been reset, thus allowing the log file to be replaced. More work is required to try and restart the service automatically. 3. Greater details of the actions of Dr Shipman have been discovered; this includes the database application that he was using (MicroDoc), and also, the company that did the digital forensic investigation (Vogon). 4. Work In Progress Supervisor’s Comments: Version 2 Napier University
Page 1 and 2:
Analysis and Evaluation of the Wind
Page 3 and 4:
Barrie Codona, BSc (Hons) Network C
Page 5 and 6:
Page 7 and 8:
Page 9 and 10:
Page 11 and 12:
Page 13 and 14:
Page 15 and 16:
Page 17 and 18:
Page 19 and 20:
Page 21 and 22:
Page 23 and 24:
Page 25 and 26: Barrie Codona, BSc (Hons) Network C
Page 75: Appendix A: Diary Sheets
Page 79 and 80: NAPIER UNIVERSITY SCHOOL OF COMPUTI
Page 85 and 86: Appendix B: Preliminary Gantt Chart
Page 87 and 88: Nov '07 Dec '07 Jan '08 Feb '08 Mar
Page 89 and 90: C:\Documents and Settings\Barrie\My
Page 95 and 96: Appendix D: Server Application Code
Page 99 and 100: Appendix E: Event Viewer Code
Page 105 and 106: Appendix G: Processor Monitor Code
Page 107 and 108: Appendix H: HMAC Brute Force Cracke
Page 113 and 114: Appendix I: Windows Event Log Tests
Page 115 and 116: Copy Security Log C:\windows\system
Page 117 and 118: Another look at the Security Log re
Page 119 and 120: The Event Service is then restarted
Page 121 and 122: Another look at the ‘c:\windows\s
Page 123 and 124: CO42019 - Project 4 Computer Name P
Page 125 and 126: CO42019 - Project 4 Turned off the
Page 127 and 128:
CO42019 - Project 4 And then restar
Page 129 and 130:
CO42019 - Project 4 Modify the ‘l
Page 131 and 132:
CO42019 - Project 4 Project - Week
Page 133 and 134:
Page 135 and 136:
Page 137 and 138:
CO42019 - Project 4 As previously d
Page 139 and 140:
CO42019 - Project 4 The screenshot
Page 141 and 142:
CO42019 - Project 4 Displaying the
Page 143 and 144:
CO42019 - Project 4 Modifying the r
Page 145 and 146:
CO42019 - Project 4 Master File Tab
Page 147 and 148:
CO42019 - Project 4 Modify the sect
Page 149 and 150:
CO42019 - Project 4 Sectors 3748520
Page 151 and 152:
CO42019 - Project 4 This now shows
show all

Analysis and Evaluation of the Windows Event Log - Bill Buchanan

Create successful ePaper yourself

Delete template?

Save as template?