Subject: Digital Forensics

Topic: Preserving and Recovering Digital Evidence

Difficulty: Medium

The most important upgrade logs are setupact.log and setuperr.log which you find in different locations depending on the upgrade stage. The two important log files setupact.log and setuperr.log use the following format:

• Date and time.

• Log Level (Info, Warning, Error, Fatal Error)

• Logging Component (CONX, MOUPG, PANTHR, SP, IBSLIB, MIG, DISM, CSI, CBS)

• Message

Windows Log file locations are as follows (open Event Viewer) –

1. Application

2. Security

3. Setup

4. System

5. Forwarded events

6. Application and service logs