By Andreas Schuster
Copyright © 2011 int for(ensic){blog;}. All rights reserved. Reproduction for commercial purposes (including online advertisement) interdicted.

Unfortunately, SANS had to postpose the London Forensics Summit due to massive travel problems caused by volcanic ash floating around the atmosphere. I intended to answer many questions from the forensic community on the native Windows Event Log file format during the presentation. I'm releasing my slides in the hope that this will answer at least some of the questions, though the narrative is missing.