Introducing and analysis of the Windows 8 event log for forensic purposes
Talebi, J, Dehghantanha, A and Ramlan, M 2015, 'Introducing and analysis of the Windows 8 event log for forensic purposes' , in: Computational Forensics , Lecture Notes in Computer Science.
- Published Version
Restricted to Repository staff only
Download (25MB) | Request a copy
All operating systems are employing some sort of logging mechanism to track and note users activities and Microsoft Windows is not an exception. Log Analysis is one of the important parts of Windows forensics process. The Windows event log system introducing in Windows NT was released with a new feature for Microsoft Windows family and since then went through several major changes and updates. The event log experienced major updated in Windows 8. This paper first introduces Windows 8 event log format and then proceeds with explaining methods for analyzing the logs for digital investigation and incident handling. The main contributions of this paper are introducing Windows8 logging service and forensic examination of it.
|Item Type:||Book Section|
|Themes:||Media, Digital Technology and the Creative Economy|
|Schools:||Schools > School of Computing, Science and Engineering > Salford Innovation Research Centre (SIRC)|
|Publisher:||Lecture Notes in Computer Science|
|Funders:||Non funded research|
|Depositing User:||Dr. Ali Dehghantanha|
|Date Deposited:||18 Aug 2015 17:57|
|Last Modified:||29 Oct 2015 00:13|
Actions (login required)
|Edit record (repository staff only)|