TABLE OF CONTENTS There are several forms of audit records and log files on network operating systems such as Windows NT and Unix. Audit records are generated as a result of low-level system calls, and system logs are generated by programs that are part of the operating system but do not detect activity at the kernel level. Additionally, programs like Web and e-mail servers have associated application logs. The most common log formats are described in this section to give practical guidance for interpreting specific types of logs and to give general tips for analyzing and utilizing them in an investigation.
Microsoft Windows NT can be configured to log a variety of events grouped into three types: system events, application events, and security events (stored in three corresponding binary files SysEvent.evt, AppEvent.evt, and SecEvent.evt). [21] As the name suggests, System logs include events in the system's operation such as a failed or successful driver startup, an application crash or errors associated with data loss. The Application log is a repository for any events recorded by applications - the type of event that is logged varies with each application. Security logs contain information such as logon and logoff events, file manipulation, and other resource access events. This section focuses on security logs but also applies to application and system logs. The format of an event log entry has three sections summarized here.
<b class="bold">Header: </b>Date, Time, Username, Computer Name, Event ID,...
