From the course: Learning Cyber Incident Response and Digital Forensics

Unlock this course with a free trial

Join today to access over 24,700 courses taught by industry experts.

Conducting log analysis

Conducting log analysis

From the course: Learning Cyber Incident Response and Digital Forensics

Start my 1-month free trial Buy for my team

Conducting log analysis

“

- [Instructor] In this lesson, you're going to learn how to conduct some basic log analysis. Now, in order to do this, we have to be able to gather the log files from the suspect's computer that we already collected as part of that disc image. Again, this is going to be found inside of JohnSmithsPC.001_147Host as that image file because this contained the entire Windows operating system, as well as everything on that C drive, both what was already there, what was deleted and what was in the Slack space. So to be able to go through the logs, we just need to go into the C drive of that machine and then access the logs using our forensic workstation's Event Viewer tool. To do this, we'll simply go over to the JohnSmithsPC that we want to look at and double-click it and then double-click JohnSmithsPC hard drive, which will show me all the different partitions, or volumes, on there. Once we do that, we see volume six, which is…

Contents