Difference between revisions of "Talk:Windows Event Log (EVT)"

From ForensicsWiki
Jump to: navigation, search
Line 1: Line 1:
 
ASchuster:  Can you provide the source of your information on the header, cursor, retention, etc?  If MSDN has this information, a link to it should be included in this page.
 
ASchuster:  Can you provide the source of your information on the header, cursor, retention, etc?  If MSDN has this information, a link to it should be included in this page.
 +
 +
This information was obtained through extensive testing. As fas as I know the only information available on MSDN is the declaration of the event record. --ASchuster

Revision as of 14:05, 15 March 2006

ASchuster: Can you provide the source of your information on the header, cursor, retention, etc? If MSDN has this information, a link to it should be included in this page.

This information was obtained through extensive testing. As fas as I know the only information available on MSDN is the declaration of the event record. --ASchuster