An analysis of Microsoft event logs

Microsoft Windows event logs are central to conducting an investigation when determining whether or not a virus has been installed on a targeted system. However, there was very little substantial research about Windows event logs and how they are used in conducting an investigation. This research explores forensic artifacts recovered during an investigation to determine whether virus activity may be involved. The research describes the relevance of the event logs and discusses various techniques used for investigators to collect and examine the logs. Three viruses, Fizzer, Zeus, and MyDoom were installed and run in virtual machines to determine what events will populate in the logs. This research also explains best practices regarding the use of Windows event logs in an investigation.