How to determine the Log-In Count and Last Log-on date of users account in Windows XP while using the autopsy tool?

Question

I'm doing some activity in my class in digital forensics I was able to find the last user who login on the computer (found it on WINDOWS/SYSTEM32/CONFIG/SOFTWARE/MICROSOFT/WINDOWS NT/CURRENT VERSION/WINLOGON/DEFAULT USER NAME). There are 5 user accounts on the computer and I need to find the log-in count per user and last log-in date per user, in what folder should I find it? I'm using the Autopsy software.

Answer 1

This explanation should help, but this will be a generic answer, as the problem is not reproducible.

Normally the "C:\Windows\System32\winevt\Logs" folder is containing the event logs on Windows systems, tracing login events. You should look for the Security.evtx file(there will be plenty of logs in there, and you are looking for 4624 logs in it). If your Autopsy version is parsing this, you should try to find interactive logins(~= normal keyboard logons, or logon type 2 see the explanation. This is an assumption).

You can either count them or it's an old Autopsy version which doesn't support parsing, export the Security.evtx file instead, and open it in Event viewer on your forensic analysis host locally, and filter(open up Security.evtx with Event Viewer, Actions/Filter Current Log/Includes Event IDs: 4624, Keywords: Audit Success, User: Xyz(and change it to the next one once examined)