Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am wondering if there is any way to inject bogus events, with past dates, into the event log. If so, how is this done and what can be done to prevent it?

share|improve this question

1 Answer 1

up vote 4 down vote accepted

The windows event log is a data structure like any other, so with the right tools, it can be manipulated at will. (No signatures etc. are used, and they would be useless, because if the computer can write the log, it can also write a fake log.)

However, the event log format is a proprietary binary file format (see the documentation), and I know of no application that would allow easy editing. Editing it would require at least some programming.

The only protection would be to report events to a separate, secure server, and store or sign them there.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.