Automated Event Log File Recovery Based on Content Characters and Internal Structure

Rapidly retrieving valuable information is vital in computer forensic, especially information with respect to the computer system itself. Attentions on the system information such as registry and event log have increasingly promoted the forensic researches. Event log is a very import file in computer, which contains a large amount of available information about what happened on the system observed, but current forensic tool on event log only can repair corrupted log files and has no effect on the situation that event log file has been fragmented. To address this problem, this paper presents an algorithm which allows search for windows event log file data fragments based solely on their data contents, without the need of any meta data. The algorithm is based on searching the signature in log file combining with computing the entropy difference between neighboring clusters. A tool was developed to automate recovery and parse of Windows NT5 (XP and 2003) event logs for computer forensic. This tool automates repair of multiple event logs and parse the recovered files without user intervention. The evaluation of this method shows an average accuracy of 82.5%, with lower false positive.