Introducing and analysis of the Windows 8 event log for forensic purposes

Talebi, J, Dehghantanha, A ORCID: https://orcid.org/0000-0002-9294-7554 and Ramlan, M 2015, 'Introducing and analysis of the Windows 8 event log for forensic purposes' , in: Computational Forensics , Lecture Notes in Computer Science, pp. 145-162.

PDF - Published Version Restricted to Repository staff only Download (25MB)

Abstract

All operating systems are employing some sort of logging mechanism to track and note users activities and Microsoft Windows is not an exception. Log Analysis is one of the important parts of Windows forensics process. The Windows event log system introducing in Windows NT was released with a new feature for Microsoft Windows family and since then went through several major changes and updates. The event log experienced major updated in Windows 8. This paper first introduces Windows 8 event log format and then proceeds with explaining methods for analyzing the logs for digital investigation and incident handling. The main contributions of this paper are introducing Windows8 logging service and forensic examination of it.

Item Type:	Book Section
Themes:	Media, Digital Technology and the Creative Economy
Schools:	Schools > School of Computing, Science and Engineering > Salford Innovation Research Centre
Publisher:	Lecture Notes in Computer Science
Refereed:	Yes
ISBN:	9783319201245
Related URLs:	Publication
Funders:	Non funded research
Depositing User:	Dr. Ali Dehghantanha
Date Deposited:	18 Aug 2015 17:57
Last Modified:	16 Feb 2022 17:05
URI:	http://usir.salford.ac.uk/id/eprint/36094

Actions (login required)

Edit record (repository staff only)