1. Mastering Windows Network Forensics and Investigation Chapter 11: Text-Based Logs

2. September 18, 2015 © Wiley Inc. 2007. All Rights Reserved 2 Chapter Topics: Windows IIS Logs Windows FTP Server Logs Windows DHCP Server Logs Windows XP Firewall Logs Microsoft Log Parser

3. Windows IIS Logs Microsoft web server is called Internet Information Services (IIS) Detailed logging enabled by default Most common & default format is WC3 Extended Log File Format Log timestamps are GMT Default location: %WinDir%\System32\Logfiles\W3SVC1\ Log per day in format exyymmdd.log, where yy=year, mm=month, & dd=day

4. Example of IIS Log Entry

5. Windows FTP Logs Microsoft FTP Server Detailed logging enabled by default Most common & default format is WC3 Extended Log File Format Log timestamps are GMT Default location: %WinDir%\System32\Logfiles\MSFTPSV C1\ Log per day in format exyymmdd.log, where yy=year, mm=month, & dd=day

6. Example of FTP Log Entry

7. Microsoft DHCP Server Logs Dynamic Host Configuration Protocol (DHCP) service in which IP address assigned dynamically upon request by host. Microsoft servers provide this services IP address loaned for a short period and thus which machine had which IP address is based on particular point in time. Logs record host to which IP was assigned Time is local system time zone!

8. Microsoft DHCP Server Logs Default location for log is: C:\%SystemRoot%\System32\DHCP\ Logs stored in one file per day basis Format of log file name is: DhcpSrvLog-XXX.log, where XXX=three letters of day of week, i.e. DhcpSrvLog-Sat.log Therefore, only 1 full week stored!

9. DHCP Log

10. Event ID Date Time (Local system time zone) Description / Action IP address assigned Host name to which IP assigned MAC address to which IP assigned

11. Windows Firewall Logs Firewall added to XP with SP 2 Firewall on by default Very good logging utility, however, is off by default Enabling is buried deep in user interface –Don’t expect to find it enabled often, except in domain settings with good administrator!

12. Windows Firewall Logs Default location of firewall logs is: %SystemRoot%\pfirewall.log Always look for it anyway

13. Windows Firewall Log Header

14. Windows Firewall Log Data

15. Microsoft Log Parser Free utility from Microsoft Truly a Swiss Army Knife forensic utility Processes nearly all forms of M/S logs, plus dozens of others Three components –Input engine –SQL query engine –Output engine

16. M/S Log Parser DATAGRID Output