NDLI: Automated Event Log File Recovery Based on Content Characters and Internal Structure

Content Provider	IEEE Xplore Digital Library
Author	Yongjian Lou Peng Wang Ming Xu Ning Zheng
Copyright Year	2009
Abstract	Rapidly retrieving valuable information is vital in computer forensic, especially information with respect to the computer system itself. Attentions on the system information such as registry and event log have increasingly promoted the forensic researches. Event log is a very import file in computer, which contains a large amount of available information about what happened on the system observed, but current forensic tool on event log only can repair corrupted log files and has no effect on the situation that event log file has been fragmented. To address this problem, this paper presents an algorithm which allows search for windows event log file data fragments based solely on their data contents, without the need of any meta data. The algorithm is based on searching the signature in log file combining with computing the entropy difference between neighboring clusters. A tool was developed to automate recovery and parse of window NT5 (XP and 2003) event logs for computer forensic. This tool automates repair of multiple event logs and parse the recovered files without user intervention. The evaluation of this method shows an average accuracy of 82.5%, with lower false positive.
Starting Page	4778
Ending Page	4781
File Size	291734
Page Count	4
File Format	PDF
ISBN	9781424449095
e-ISBN	9781424457281
DOI	10.1109/ICISE.2009.351
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2009-12-26
Publisher Place	China
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Information science Content based retrieval Image analysis File systems Digital forensics Image retrieval Clustering algorithms Information retrieval Software Entropy
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Validation Algorithms Based on Content Characters and Internal Structure: The PDF File Carving Method

Tracking File's Metadata from Computer Memory Analysis

Image Fragment Carving Algorithms Based on Pixel Similarity

Vista event log file parsing based on XML technology

Reassembly of Fragmented JPEG Images Containing Restart Markers

An Efficient Image Retrieval Approach base on Color Clustering

Image Retrieval Based on Fuzzy Kernel Clustering and Invariant Moments

Automated reassembly of file fragmented images using greedy algorithms

Logical data recovery technique for USB devices

Automated Event Log File Recovery Based on Content Characters and Internal Structure

Similar Documents

Validation Algorithms Based on Content Characters and Internal Structure: The PDF File Carving Method

Tracking File's Metadata from Computer Memory Analysis

Image Fragment Carving Algorithms Based on Pixel Similarity

Vista event log file parsing based on XML technology

Reassembly of Fragmented JPEG Images Containing Restart Markers

An Efficient Image Retrieval Approach base on Color Clustering

Image Retrieval Based on Fuzzy Kernel Clustering and Invariant Moments

Automated reassembly of file fragmented images using greedy algorithms

Logical data recovery technique for USB devices

Automated Event Log File Recovery Based on Content Characters and Internal Structure