New Chainsaw tool helps IR teams analyze Windows event logs
Windows event logs are a ledger of the system’s activities. Forensic investigators rely on these records, sometimes as the main source of evidence, to create a timeline of events of interest.
