Analysis and Evaluation of the Windows Event Log - Bill Buchanan

NAPIER UNIVERSITY
SCHOOL OF COMPUTING
PROJECT DIARY
Student: Barrie Codona
Supervisor: Bill Buchanan
Date: 19 th March 2008 Last diary date: 20 th February 2008
Objectives:
1. Convert all the event tags to an XML format.
2. Encrypt the client server communication using RSA.
3. Ensure that both the client and server applications are not missing any events that happen.
Progress:
1. A fairly trivial modification to the application, but one that will allow the outputted data to be more
easily read by other applications. This is not formatted in true XML but it does use the opening and
closing tags for each string of information. For example
2. Using the supplied sample code provided by Bill’s Advanced Security and Forensic Computing
module, a test application was developed that would allow for the program to be reconstructed from
a windows environment to a console one. It was also modified so that the public and private keys
were automatically generated when a client connects to the server. The public key is then sent to
the server and allows for secure communication between them both. This worked fine for small
amounts of information being sent, but larger amounts caused the RSA function to crash, this was
probably because the key being used was smaller than the message that is being sent – it was
resolved by breaking the original message into smaller sections and then encrypting each section
and rebuilding the original message at the server. The next problem encountered was an “Invalid
character” error in the decrypted string, after a lot of time investigating this it turned out to be the
size of the TCP packets were too small and some information was being dropped.
3. A very simple application was developed that uses a ‘for loop’ to generate 1000 text files that are all
sequentially numbered from 0 to 999. The event monitoring software is started up and its logs are
manually checked to ensure that it has captured all of these events. Initially it failed to log all of the
events but this was easily sorted by increasing the buffer size that the ‘FileSystemWatcher’ uses.
Supervisor’s Comments:
Version 2
Napier University