A FORENSIC PERSPECTIVE ON THE USE OF EVENT VIEWER FOR DETECTING MALICIOUS ACTIVITIES AND ENSURING SYSTEM INTEGRITY

Abstract

Event Viewer is a vital tool embedded within Microsoft Windows that records a wide range of system, security, and application-related events. For forensic investigators, these logs are crucial in identifying signs of malicious activities, reconstructing timelines, and maintaining system integrity. This paper highlights the role of Event Viewer in digital forensics, discussing how specific logs from various categories—Application, Security, Setup, System, and Forwarded Events—can be extracted, parsed, and stored in XML format for in-depth analysis. Furthermore, the paper proposes a structured XML-based data model for efficient forensic storage and analysis, compares it with other log management approaches, and demonstrates its effectiveness in digital investigations.