I'm doing some activity in my class in digital forensics I was able to find the last user who login on the computer (found it on WINDOWS/SYSTEM32/CONFIG/SOFTWARE/MICROSOFT/WINDOWS NT/CURRENT VERSION/WINLOGON/DEFAULT USER NAME). There are 5 user accounts on the computer and I need to find the log-in count per user and last log-in date per user, in what folder should I find it? I'm using the Autopsy software.
How to determine the Log-In Count and Last Log-on date of users account in Windows XP while using the autopsy tool?
5.5k Views Asked by Babayaga At
1
There are 1 best solutions below
Related Questions in WINDOWS-XP
- ASP.MVC Castle Nlog Count does not reset
- Castle Windsor registering components that match the same services
- Resolving Interface with generic type constraint with Castle Windsor
- Passing Additional Parameters in Windsor castle
- Use a registered component in the Castle container to supply a dependency for another component
- Which Namespace holds Component.For in Castle Windsor?
- Castle Windsor & Command Pattern
- Resolving generics with Castle Windsor in WCF
- Using same parameter value in a dependency with Windsor
- Abstracting away any configuration using IConfigurationStore and IWindsorInstaller
Related Questions in COMPUTER-FORENSICS
- ASP.MVC Castle Nlog Count does not reset
- Castle Windsor registering components that match the same services
- Resolving Interface with generic type constraint with Castle Windsor
- Passing Additional Parameters in Windsor castle
- Use a registered component in the Castle container to supply a dependency for another component
- Which Namespace holds Component.For in Castle Windsor?
- Castle Windsor & Command Pattern
- Resolving generics with Castle Windsor in WCF
- Using same parameter value in a dependency with Windsor
- Abstracting away any configuration using IConfigurationStore and IWindsorInstaller
Related Questions in SYSTEM32
- ASP.MVC Castle Nlog Count does not reset
- Castle Windsor registering components that match the same services
- Resolving Interface with generic type constraint with Castle Windsor
- Passing Additional Parameters in Windsor castle
- Use a registered component in the Castle container to supply a dependency for another component
- Which Namespace holds Component.For in Castle Windsor?
- Castle Windsor & Command Pattern
- Resolving generics with Castle Windsor in WCF
- Using same parameter value in a dependency with Windsor
- Abstracting away any configuration using IConfigurationStore and IWindsorInstaller
Trending Questions
- UIImageView Frame Doesn't Reflect Constraints
- Is it possible to use adb commands to click on a view by finding its ID?
- How to create a new web character symbol recognizable by html/javascript?
- Why isn't my CSS3 animation smooth in Google Chrome (but very smooth on other browsers)?
- Heap Gives Page Fault
- Connect ffmpeg to Visual Studio 2008
- Both Object- and ValueAnimator jumps when Duration is set above API LvL 24
- How to avoid default initialization of objects in std::vector?
- second argument of the command line arguments in a format other than char** argv or char* argv[]
- How to improve efficiency of algorithm which generates next lexicographic permutation?
- Navigating to the another actvity app getting crash in android
- How to read the particular message format in android and store in sqlite database?
- Resetting inventory status after order is cancelled
- Efficiently compute powers of X in SSE/AVX
- Insert into an external database using ajax and php : POST 500 (Internal Server Error)
Popular # Hahtags
Popular Questions
- How do I undo the most recent local commits in Git?
- How can I remove a specific item from an array in JavaScript?
- How do I delete a Git branch locally and remotely?
- Find all files containing a specific text (string) on Linux?
- How do I revert a Git repository to a previous commit?
- How do I create an HTML button that acts like a link?
- How do I check out a remote Git branch?
- How do I force "git pull" to overwrite local files?
- How do I list all files of a directory?
- How to check whether a string contains a substring in JavaScript?
- How do I redirect to another webpage?
- How can I iterate over rows in a Pandas DataFrame?
- How do I convert a String to an int in Java?
- Does Python have a string 'contains' substring method?
- How do I check if a string contains a specific word?
This explanation should help, but this will be a generic answer, as the problem is not reproducible.
Normally the "C:\Windows\System32\winevt\Logs" folder is containing the event logs on Windows systems, tracing login events. You should look for the Security.evtx file(there will be plenty of logs in there, and you are looking for 4624 logs in it). If your Autopsy version is parsing this, you should try to find interactive logins(~= normal keyboard logons, or logon type 2 see the explanation. This is an assumption).
You can either count them or it's an old Autopsy version which doesn't support parsing, export the Security.evtx file instead, and open it in Event viewer on your forensic analysis host locally, and filter(open up Security.evtx with Event Viewer, Actions/Filter Current Log/Includes Event IDs: 4624, Keywords: Audit Success, User: Xyz(and change it to the next one once examined)