Comparative analysis of security event audit tools using the example of access to objects in WINDOWS and LINUX OS at the initial stage of IT forensics
Year: 2025
Type: conference-paper
Abstract: The article provides a comparative analysis of tools for auditing access to objects in Windows and Linux OS for IT forensics tasks. The study highlights the differences in approaches to monitoring security events: Windows (security log, Sysmon, GPO) provides ease of configuration, but is limited by the load, while Linux (auditd) provides detail at the level of system calls, requiring expert knowledge. The results showed that Linux is more effective for investigations due to the depth of data, while Windows simplifies management through graphical interfaces. Integration of tools with SIEM systems for hybrid environments is proposed.
Authors: N.O. Strelkov, A.D. Zakurdaev
Institution: Moscow Power Engineering Institute
Language: English
Topic: Digital and Cyber Forensics
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: gold
OpenAlex ID: W4411159518