Event logs provide an audit trail that records user events and activities on a computer and are a potential source of evidence in digital forensic investigations. This paper presents a Windows event forensic process (WinEFP) for analyzing Windows operating system event log files. The WinEFP covers a number of relevant events that are encountered in Windows forensics. As such, it provides practitioners with guidance on the use of Windows event logs in digital forensic investigations.
CITATION STYLE
Do, Q., Martini, B., Looi, J., Wang, Y., & Choo, K. K. (2014). Windows event forensic process. In IFIP Advances in Information and Communication Technology (Vol. 433, pp. 87–100). Springer New York LLC. https://doi.org/10.1007/978-3-662-44952-3_7
Mendeley helps you to discover research relevant for your work.