Full Disclosure mailing list archives
Re: write events log to CD?
From: Harlan Carvey <keydet89 () yahoo com>
Date: Mon, 30 Aug 2004 03:26:01 -0700 (PDT)
Ali,
Sending logs to a printer makes the most sense to me. Absolutely unhijackable, and a good use for that old 9-pin dotmatrix and 2000 sheets of traction feed paper you have in the cupboard. No idea whether it's possible on windows, though.
Why wouldn't this work? Windows is able to print...so your idea should work. However, I'm not sure I see a great deal of efficiency in doing so. Perhaps a better idea would be to get the Event Log entries off of the system as they are generated, using a mechanism such as syslog. Along those lines, if you go to http://patriot.net/~carvdawg/perl.html, you'll find a Perl script named wmievt.pl...this script uses WMI to watch the Event Log for new events. When a new event is generated, the script "wakes up". This is just a barebones, proof-of-concept script. I will be fleshing it out a bit and releasing on the web site for my book (book: "Windows Forensics and Incident Recovery", web site: http://www.windows-ir.com). Hope that helps, Harlan _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- write events log to CD? BillyBobKnob (Aug 29)
- Re: write events log to CD? VeNoMouS (Aug 29)
- Re: write events log to CD? Ali Campbell (Aug 29)
- Re: write events log to CD? Barrie Dempster (Aug 30)
- Re: write events log to CD? Harlan Carvey (Aug 30)
- Viral infection via Serial Cable Jean Gruneberg (Aug 30)
- Re: Viral infection via Serial Cable Über GuidoZ (Aug 30)
- RE: Viral infection via Serial Cable Jean Gruneberg (Aug 30)
- Re: Viral infection via Serial Cable Über GuidoZ (Aug 30)
- Re: Viral infection via Serial Cable Christian (Aug 30)
- Re: Viral infection via Serial Cable Christian (Aug 30)
- Re: write events log to CD? Ali Campbell (Aug 29)
- Re: Viral infection via Serial Cable James Tucker (Aug 30)
- Re: write events log to CD? VeNoMouS (Aug 29)
- Re: Viral infection via Serial Cable J.A. Terranson (Aug 30)
- Re: Viral infection via Serial Cable James Tucker (Aug 31)
- Re: Viral infection via Serial Cable Barry Fitzgerald (Aug 31)