Forensics Mastery: EVENT LOGS

3 Main Event Log Types

• Security

• Firewall

• Application

• System

Type of event log where you can find software logs unrelated to operating systems

• Security

• Application

• System

• PowerShell

Event ID for Failed Logons

• 4624

• 4634

• 4625

• 4672

Event Logs on Windows 10 can be found on this location?

• %systemroot%\System32\winevt\logs

• •%systemroot%\System32\config

• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\logfile

Answer explanation

For Vista / Win7 / Win8 / 2008 / 2012 / Win10 / 2016, event logs can be found in

•%systemroot%\System32\winevt\logs

"Service fails to load", is an example of what event type?

• Success Audit

• Information

• Error

• Warning

Description for Logon Type 2

• Logon via console

• Network Logon

• Batch Logon

• Remote Interactive Logon

In what event log type can we check valid and invalid logins and logoffs?

• System

• Application

• Customer

• Security

Choose the correct Logon Type: This event occurs when using RunAs command with /netonly option. Let’s say you need to run a program, but grant it extra permissions for network computers.

• Logon Type 2

• Logon Type 7

• Logon Type 9

• Logon Type 10

Tool you can't use to view or parse event logs

• Event Viewer

• Event Explorer

• EvtECmd

• Timeline Explorer

Which is not an example of Custom event logs?

• Windows PowerShell

• Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational

• Application

• Microsoft-Windows-WMI-Activity%4Operational