Analysis and Evaluation of the Windows Event Log - Bill Buchanan

NAPIER UNIVERSITY
SCHOOL OF COMPUTING
PROJECT DIARY
Student: Barrie Codona
Supervisor: Bill Buchanan
Date: 14 th December 2007 Last diary date: 7 th December 2007
Objectives:
1. Continue work on an introduction for the project.
Progress:
1. Work has continued on the Introduction for the project, it is almost complete. It starts of with the
initial sentence that was supplied in the project hand book “The windows event log is used in digital
forensic cases…” and then gives a couple of examples of where it has been used in digital forensic
cases. It then introduces the reader to some of the security vulnerabilities of the event logging
service. The report then provides some background information about the event log and that,
according to Microsoft; it was designed to be used as a diagnostic tool. An example of how a
logging server would be setup in a corporate environment is given; this involves having the log
server connected directly, via a firewall, to a domain controller using a second NIC in the server.
The report then introduces the design flaws that are in the event logging service and how more
accurate information, with regards to the current state of the system, needs to be captured.
Supervisor’s Comments:
Version 2
Napier University