I am wondering if there is any way to inject bogus events, with past dates, into the event log. If so, how is this done and what can be done to prevent it?
Tell me more
×
Super User is a question and answer site for
computer enthusiasts and power users. It's 100% free, no registration required.
|
|
||||
|
|
|
The windows event log is a data structure like any other, so with the right tools, it can be manipulated at will. (No signatures etc. are used, and they would be useless, because if the computer can write the log, it can also write a fake log.) However, the event log format is a proprietary binary file format (see the documentation), and I know of no application that would allow easy editing. Editing it would require at least some programming. The only protection would be to report events to a separate, secure server, and store or sign them there. |
|||
|
|
