Mastering Windows Network Forensics and Investigation, 2nd Edition

Chapter 12: Windows Event Logs

Explain how Windows event logs are stored. Event log files are natively stored in a binary format in files with an .evtx or .evt extension. By default, these log files are stored in the %SystemRoot%\System32\Logfiles folder in Windows Vista and beyond or the %SystemRoot%\System32\config folder. There are three default event logs on Windows systems: Application, Security, and System. The Security log is arguably the most important to investigators since it stores data related to system and object access.

Master It Explain how the event logs differ from the text logs discussed in Chapter 11.

Solution Since event logs are stored as binary data instead of plain text, they require special software to interpret them. ...