Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am wondering if there is any way to inject bogus events, with past dates, into the event log. If so, how is this done and what can be done to prevent it?

share|improve this question
up vote 4 down vote accepted

The windows event log is a data structure like any other, so with the right tools, it can be manipulated at will. (No signatures etc. are used, and they would be useless, because if the computer can write the log, it can also write a fake log.)

However, the event log format is a proprietary binary file format (see the documentation), and I know of no application that would allow easy editing. Editing it would require at least some programming.

The only protection would be to report events to a separate, secure server, and store or sign them there.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .