Events Forensic Tools for Microsoft Windows

Transcription

1 Events Forensic Tools for Microsoft Windows Professional forensic tools

2 Events Forensic Tools for Windows Easy Events Log Management Events Forensic Tools (EFT) is a fast, easy to use and very effective solution for analyzing, viewing and monitoring Security, System, Application and other Microsoft Windows operating systems event logs. Unlike limited Windows Event Viewer, EFT extends standard functionality and brings monitoring and many new features. Any system administrator, forensic examiner or security specialist know the problem of Windows event log and how this problem is acute. Keeping tracing and monitoring continuously of valid and invalid logon attempts and events related to resources usage such as opening, creating and deleting files is a critical task to make sure the network is safe and clean. This process always devours a lot of time using MS Windows Event Viewer. EFT designed to let you quickly browse, search, find and report problems, security warnings in addition to all other generated within Windows events such as Security, System, Application, Directory Service, DNS and other logs of the Operating Systems. EFT equipped with event search and filtering engine to sort events in the list by any criteria. User can create many filters and save them. This will save when you want to re-apply the filter in future. Unlike the limitation of standard Windows Event Viewer, EFT can print event logs or separate events, export them to other formats (currently: HTML, MS Excel and tab-separated files). Additionally, the software provided with Analytical Reports tools to help system administrators building different summary tables and summary diagrams by using advanced reporting tools. EFT is a professional software utility, but it s not dedicated for professional use only, it is helpful home users will find as well to monitor System log and Security log even on a home PC. System log helps to detect failures of hardware and system and to monitor system services and other resources. Security log lets you audit your PC and monitor access to MS Windows resources like files, folders and registry keys, trace logon attempts and perform many other auditing tasks.

3 Events Forensic Tools features and benefits EFT is a customer-driven software. Most of the advanced features were requested by our users and this turned it from ordinary event data viewing to its real analysis. Accessing MS Windows event logs (and log files) on local and remote servers and workstations: Like standard MS Windows Event Viewer, EFT can access MS Windows event logs and event log files from both local and remote servers and workstations. However unlike Event Viewer, you can view several event logs (and log files) at one time in separate windows or as tabs in one consolidated window (merged event log view). Support of both classic Windows NT event log format (EVT files) and new (Crimson) event log format (EVTX files) You can choose between legacy Windows NT API or modern Windows Event Log API - when possible - to access MS Windows event logs (and log files). Legacy NT API works faster, but Modern API works provides more detailed information. High performance all events are loaded either into memory or into an optimized internal local database EFT reads events into its own temporary storage to guarantee smooth event analysis. User can set memory or disk storage to use depending on event log size. Active monitoring and alerting be informed about problems in real-time EFT can be setup to monitor events generated by the systems and notify you when a specified event has fired. This helps to get alerted promptly and potentially before problems affect you.

4 Event log consolidation consolidating in one place different events EFT allows to consolidate events from different sources in one event view to review as a solid log. The consolidated event log can be saved as an EVT file. Setting Tabbed-document and multiple-document user interface EFT has two different user interface types. o Multiple-document interface (MDI) which allows to open unlimited number of event logs and place all of them in the main window of EFT. o Tabbed-document interface (TDI) that allows to open unlimited number of event logs and provide the best navigation between logs way. Pre-filter Windows event logs (log loading options) With EFT you may load events from dozens of Windows servers and workstations simultaneously. Normally, you don't need to load all events from all logs and log loading options help you to pre-filter events at loading stage (e.g. to exclude information events or to load only recent events). Advanced filtering Events can be filtered by any criteria including event description text. Filters can be saved as a files and reused to filter to other event logs. You can use regular expressions (Regexps) to filter by event description text. EFT lets you link events by event ID and description parameters and filter out all other events. Linked event filtering feature helps analyzing Security log. Grouping favorite computers and their logs into a tree With EFT you can view event logs on different MS Windows servers and workstations. For simplification, computers can be grouped in a tree. Then you can select the desired event log to be opened immediately.

5 Backup of Windows event logs Event logs backup is an important task. Large event logs may affect system performance, and system administrators can t rotate them to cut down their size which means in this case they wont be able to analyze past events. The appropriate solution is to limit the size of MS Windows event logs, and back them up on regular basis. EFT allows you to save event logs as event log files manually or automatically by scheduling backup time. Fast bookmarks navigation Modern Internet browsers allow you to save favorite URLs as bookmarks that can be easily restored. Similarly Events Forensic Tools allows you to bookmark and easily return to these events at anytime. Popular event knowledge bases compatibility Sometimes user can get more information about an event in the public event knowledge bases. EFT supports EventID.net and Microsoft knowledgebase. Color coding by Event ID Color coding allows to easily distinguish between different events. User can change text color, font style and background color for specific events. Printing and exporting in different formats With EFT you can print MS Windows event logs and export in other formats. Printing options let you select one of several printing styles. EFT currently supports export to HTML, tab-separated files and MS Excel documents. Analytical reports - summary tables and pivot charts You can easily create pivot tables and chart reports of events to summarize event types by date or get statistics by event identifier, event source, etc.

6 Reading damaged EVT files and generating EVT files from selected events EFT can access EVT files directly (without MS Windows Event Log API). This allows reading damaged event logs and event logs when MS Windows Event Log service is not available (e.g. in BartPE or other preinstalled environment). You can also generate your own EVT files. Reading new EVTX files on old MS Windows versions EFT can access EVTX files directly (without new MS Windows Event Log API). This allows you to open new event log files (EVTX) on any computer, i.e. with EFT you can read EVTX files on Windows XP machines. Scheduling to run event log tasks EFT can automate some tasks using built-in scheduler. For example, to schedule event log export or print tasks. Credential manager For opening an event log from a remote server or workstation, EFT will use your current credentials for accessing, but sometimes you may need alternative credentials to access remote event logs. Credential manager stores different credentials for each machine and use them when you are opening a remote MS Windows event log. Sorting event list by any column and in any direction Similar to MS Windows Event Viewer, EFT lets you sort event list by any column - just click on the column header, and event list will be re-sorted immediately. If you double-click it, the event list will be resorted in the backward direction. In the EFT preferences, you can set the default sorting which will be applied when you opening a log. Time correction As standard, Event time is stored as UTC time. When you open a log generated on a remote server located in different time-zone, you may want to move virtually to that time-zone and view events from there. Time correction lets you to view event from any time zone. Servers import Importing a large network from one to other software solution is a complicated job. To import a network of any size to EFT, you can create a list of your servers and workstations and EFT will do the rest by import them all or simply EFT to scan your network (Active Directory) and build the list of your computers automatically.