Sufficiency of Windows Event Log as Evidence in Digital Forensics

摘要: The prevalence of computer and the internet has brought forth increasing spate cybercrime activities; hence need for evidence to attribute a crime suspect. research therefore, centres on evidence, legal standards applied digital presented in court main sources Windows OS, such as Registry, slack space event log. In order achieve aim this research, activities automated password guessing attack hacking was emulated OS within virtual network environment set up using VMware workstation. After logs victim system analysed assessed its admissibility (evidence must conform certain rules), weight convince that accused committed crime).