1. Mastering Windows Network Forensics and Investigation Chapter 11: Text Based Logs

2. Chapter Topics: Locate and find evidence in IIS logs Locate and find evidence in FTP server logs Locate and find evidence in DHCP logs Locate and find evidence in Windows 7 firewall logs

3. Parsing IIS Logs IIS Management console

4. Parsing IIS Logs W3C Extended format is default setting –U_exyymmdd.log –All timestamps and entries recorded in GMT c- = client actions s- = server actions cs- = client to server actions sc- = server to client actions

5. Parsing IIS Logs Server status codes –200 = OK –400 = Bad Request –404 = Not Found –500 = Internal Server Error

6. Parsing FTP Logs File Transfer Protocol server –Same format as IIS W3C Extended Does not record the following: –cs-uri-query –cs-host –cs(User-Agent) –cs(Cookie) –cs(Referrer)

7. Parsing FTP Logs Server Status Codes different from IIS –220 = Service ready for new user –225 = Data connection open –230 = User logged on Timestamps stored using GMT by default

8. Parsing DHCP Logs Dynamic Host Configuration Protocol –Tracks leased IP addresses to requesting clients Format –ID –Date –Time –Description –IP address –Host Name –MAC Address

9. Parsing Windows Firewall Logs Disabled by default Logs are stored in W3C Extended format –Extended Fields used: Date Time Action Protocol src-ip dst-ip src-port dst-port

10. Parsing Windows Firewall Logs