Event Viewer

How To collect Windows Event Logs

🖥️ Windows Forensics — What Happened on This System? Windows forensics is the process of analyzing Windows systems to uncover user activity, security incidents, and malicious behavior. By examining system artifacts, investigators can reconstruct timelines and understand exactly what occurred. What’s typically analyzed: • Event logs and security records • Registry and user activity artifacts • File system metadata and deleted files • Memory and running processes • Browser usage and persistence m

Windows Defender logs location in Windows 11/10

🕵️‍♂️ Windows Forensics – What You Should Know Windows Forensics focuses on identifying, collecting, and analysing evidence from Windows-based systems after a security incident. It helps investigators understand how an intrusion happened, what actions were performed, and what data may have been accessed or altered. A typical forensic workflow includes examining system logs, registry keys, event traces, memory artifacts, browsing history, and installed applications. Analysts also inspect persist