Abstract
The Microsoft Windows system provides very important sources of forensic evidence. However, few attention has been paid to the recovery of the deleted EVTX logs. Without using system metadata, a novel carving algorithm of EVTX logs is proposed by analyzing the characteristics and intrinsic structure. Firstly, we reassemble binary data belonging to fragments of complete EVTX logs to reconstruct the deleted logs. Secondly, extracting records for the corrupted logs can make the algorithm robust through the special features of template and substitution array. Finally, some experiments are given to illustrate the effectiveness of the proposed algorithm. Moreover, when the logs are fragmented or corrupted, our algorithm can still perform well.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
Notes
- 1.
EnCase offers investigators the flexibility to collect critical evidence including text messages, call records, pictures, graphics, and much more.
- 2.
Record ID is the same as record number.
- 3.
WinHex is a disk editor and a hex editor useful in data recovery and forensics.
- 4.
We use R/O(Recovered/original), PR(Precision rate), RR(Recall rate), F(F-value) and Time to evaluate the quality of results accurately.
References
Sharma, H., Sabharwal, N.: Investigating the implications of virtual forensics. In: 2012 International Conference on Advances in Engineering, Science and Management (ICAESM), pp. 617–620. IEEE (2012)
Garfinkel, S.L.: Carving contiguous and fragmented files with fast object validation. Digit. Invest. 4, 2–12 (2007)
Murphey, R.: Automated windows event log forensics. Digit. Invest. 4, 92–100 (2007)
Al-Nemrat, A., Ibrahim, N., Jahankhan, H.: Sufficiency of windows event log as evidence in digital forensics. University of East London, London
Schuster, A.: Introducing the Microsoft Vista event log file format. Digit. Invest. 4, 65–72 (2007)
Xiaoyu, H., Shunxiang, W.: Vista event log file parsing based on XML technology. In: 4th International Conference on Computer Science & Education, ICCSE 2009, pp. 1186–1190. IEEE (2009)
Talebi, J., Dehghantanha, A., Mahmoud, R.: Introducing and analysis of the Windows 8 event log for forensic purposes. In: Garain, U., Shafait, F. (eds.) IWCF 2012/2014. LNCS, vol. 8915, pp. 145–162. Springer, Cham (2015). https://doi.org/10.1007/978-3-319-20125-2_13
Do, Q., Martini, B., Looi, J., Wang, Y., Choo, K.-K.: Windows event forensic process. In: Peterson, G., Shenoi, S. (eds.) DigitalForensics 2014. IAICT, vol. 433, pp. 87–100. Springer, Heidelberg (2014). https://doi.org/10.1007/978-3-662-44952-3_7
Mikus, N.: An analysis of disc carving techniques. Technical report, DTIC Document (2005)
Richard III, G.G., Roussev, V.: Scalpel: a frugal, high performance file carver. In: Refereed Proceedings of the Digital Forensic Research Workshop, DFRWS 2005, pp. 1–10, Astor Crowne Plaza, New Orleans, Louisiana, USA, August (2005)
Karresand, M., Shahmehri, N.: Reassembly of fragmented JPEG images containing restart markers. In: European Conference on Computer Network Defense, EC2ND 2008, pp. 25–32. IEEE (2008)
Na, G.-H., Shim, K.-S., Moon, K.-W., Kong, S.G., Kim, E.-S., Lee, J.: Frame-based recovery of corrupted video files using video codec specifications. IEEE Trans. Image Process. 23(2), 517–526 (2014)
Cohen, M.I.: Advanced carving techniques. Digital Invest. 4(3), 119–128 (2007)
Boddington, R., Hobbs, V., Mann, G.: Validating digital evidence for legal argument, p. 42 (2008)
Acknowledgment
This work is supported by the National Key R&D Plan of China under grant no. 2016YFB0800201, the Natural Science Foundation of China under grant no. 61070212 and 61572165, the State Key Program of Zhejiang Province Natural Science Foundation of China under grant no. LZ15F020003, the Key research and development plan project of Zhejiang Province under grant no. 2017C01065, the Key Lab of Information Network Security, Ministry of Public Security, under grant no. C16603.
Author information
Authors and Affiliations
Corresponding authors
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2018 ICST Institute for Computer Sciences, Social Informatics and Telecommunications Engineering
About this paper
Cite this paper
Xu, M. et al. (2018). A Novel File Carving Algorithm for EVTX Logs. In: Matoušek, P., Schmiedecker, M. (eds) Digital Forensics and Cyber Crime. ICDF2C 2017. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, vol 216. Springer, Cham. https://doi.org/10.1007/978-3-319-73697-6_7
Download citation
DOI: https://doi.org/10.1007/978-3-319-73697-6_7
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-73696-9
Online ISBN: 978-3-319-73697-6
eBook Packages: Computer ScienceComputer Science (R0)