Analysis and Evaluation of the Windows Event Log - Bill Buchanan

NAPIER UNIVERSITY
SCHOOL OF COMPUTING
PROJECT DIARY
Student: Barrie Codona
Supervisor: Bill Buchanan
Date: 9 th November 2007 Last diary date: 2 nd November 2007
Objectives:
1. Investigate the structure of NTFS to allow the by-passing of the operating system
2. Investigate the possibility of modifying the contents of the hard disc while the event service is
still running.
3. Investigate the possibilities of modifying the contents of the MFT. (Getting it to point to another
file).
4. Begin development of a system that will create a real time back up of the event logs.
Progress:
1. It was discovered that NTFS uses a system called the Master File System (MFT). This is contained
on the root directory of the boot drive, its file name is $MFT. The MFT is a relation database that
contains various information about all the files on the drive.
2. Using ‘Directory Snoop’ to examine the MFT. This provides some information on the sectors of
the event log files. Unfortunately this test did not return the results that were hoped for, however it
has given some insight on how the event service works.
3. Based upon the results from the last test, it has been concluded that even if it were possible to
modify the MFT and get it to point to a new file, the system would overwrite the contents of the file
with the contents it has in memory when the computer was shutdown. Perhaps the memory could
be modified in a similar way to the disc.
4. Contained within the Week 6 Weekly Report is an initial design specification of what the
application might do.
Supervisor’s Comments:
Version 2
Napier University