• Jennifer George
• Prathiba M

Windows Event Logs constitute a critical source of digital evidence in forensic investigations by capturing detailed records of system and user activities. This study proposes a structured and automated forensic analysis framework for the extraction, processing, and correlation of Windows Event Logs to identify forensic artifacts and reconstruct system behavior. The proposed framework integrates PowerShell-based log acquisition with Python-driven data processing and analysis. Relevant event logs are extracted using targeted Event ID filtering and transformed into a structured dataset. A timeline reconstruction module organizes events chronologically, while a rule-based correlation engine identifies relationships between authentication events, process execution, file access, and account management activities. The framework was evaluated using a controlled experimental environment in which multiple system activities were simulated to generate forensic artifacts. The results demonstrate that the proposed approach enables efficient handling of large volumes of log data, supports accurate timeline reconstruction, and facilitates the identification of behavioral patterns. Although no complete malicious sequences were observed in the experimental dataset, the framework successfully detected partial indicators of suspicious activity and validated its applicability for forensic investigations. The study highlights the effectiveness of automated event log analysis in improving the accuracy, scalability, and efficiency of digital forensic processes, and provides a foundation for future enhancements using advanced anomaly detection techniques.

Windows Event Logs, Digital Forensics, Event Correlation, Timeline Reconstruction, Log Analysis, Forensic Artifacts, PowerShell, Python

"Windows Event Log Analysis with special focus on artifacts pertaining to Forensic Analysis.", International Journal of Emerging Technologies and Innovative Research (www.jetir.org), ISSN:2349-5162, Vol.13, Issue 3, page no.h321-h335, March-2026, Available :http://www.jetir.org/papers/JETIR2603742.pdf

"Windows Event Log Analysis with special focus on artifacts pertaining to Forensic Analysis.", International Journal of Emerging Technologies and Innovative Research (www.jetir.org | UGC and issn Approved), ISSN:2349-5162, Vol.13, Issue 3, page no. pph321-h335, March-2026, Available at : http://www.jetir.org/papers/JETIR2603742.pdf