November 2020

Computer networks all around the world generate daily records of events occurring in their system. Some events are routine while others indicate potential security breaches or weak network health. Event log files consist of log information that can help organizations reduce their exposure against malware, intruders, damages and legal obligations. 

This useful log data has to be gathered, stored, monitored and managed by enterprises to meet regulatory compliance requirements by standards such as HIPAA, Sarbanes Oxley, GLB, Basel II, PCI DSS, FISMA and NISPOM. This can be quite a tiresome job as log files come in various formats from different sources and in large numbers. 

Your network devices and servers produce thousands of system event log entries every day. Approximately 95% of your log files record entries of all events or transactions taking place in your system, such as user logins and server crashes. When reviewing logs manually, it is highly unlikely to successfully locate a security or compliance issue.  

Forensic analysis refers to the process of collecting documents and evidence from a system or drive that was involved in cybercrime. For detecting a malware infection on a Windows computer, the process of forensic analysis has four different components. Let’s try to understand the components.

It starts with obtaining an image of the drive contents or data for computer forensics, mounting it on a forensic image processing software, identifying potential blind spots for analysis, and then analyzing the malware as its whole. So, these are the four components in forensic analysis.