Event Log Forensics with Log Parser

As a continuation of the “Introduction to Windows Forensics” series, this video introduces Log Parser. This powerful tool from Microsoft allows forensic examiners to query text-based data such as log files, CSV files, XML files, and numerous other data sources including Active Directory and the Registry. In this video, Richard Davis will show you how Log Parser can allow forensic examiners to query numerous Windows EVTX event logs using SQL syntax: