Event log analysis with Magnet AXIOM

Let's keep using Magnet AXIOM to explore some of the most common Windows OS forensic artifacts. In this recipe, we will show you how to examine Windows Event Logs using this tool.

Getting ready

You have already used this tool recently to collect the Recycle Bin data from a forensic image. This time, we are interested in Event Logs examination, but you can use the same case as for the Recycle Bin if you processed the whole image with default options.

How to do it...

The steps for Event log analysis using Magnet AXIOM are as follows:

1. Open the case you used for the Recycle Bin forensic analysis and go to the OPERATING SYSTEM artifacts list again, but now choose Windows Event Logs, as in the following figure:

Figure 7.11. Operating system artifacts list

2. As you can see in the preceding figure, we have a huge number of event logs. To make your analysis easier, you can sort them. For example, we used the Created Date/Time column to sort our event logs. You can see...