PowerShell EventLog CmdLets — 80s/90s retrowave notes from the vault

Related notes

PowerShell Function Basics and Recursion
#powershell #programming-basics #recursion
The 5 Principles of Digital Forensics
#forensics #digital forensics #incident response #security
Core Principles of Forensic Science
#forensics #digital forensics #principles #Locard's Exchange Principle
Synthesis: Core Forensic Principles in Practice
#forensics #digital-forensics #principles #synthesis
Evidence Acquisition Fundamentals
#forensics #acquisition #hashing #chain-of-custody
Convergent vs Divergent Thinking
#thinking #problem-solving #forensics #learning
PowerShell as an Acquisition Engine
#powershell #acquisition #digital-forensics #incident-response
PowerShell Cross-Platform
#powershell #cross-platform #linux #macos
Experimenting with PowerShell
#powershell #powershell-ise #windows #cmdlet
PowerShell ISE Panels
#powershell #powershell-ise #digital-forensics #cmdlet
Forensic Analyst as Insider Threat
#forensics #ethics #footprint #chain-of-custody
Footprint (Forensic)
#forensics #digital-forensics #network-forensics #live-systems
Direct Evidence
#forensics #digital-forensics #network-forensics #legal
Hearsay
#forensics #digital-forensics #network-forensics #legal
Business Records
#forensics #digital-forensics #network-forensics #legal
Digital Evidence
#forensics #digital-forensics #network-forensics #legal
Real Evidence
#forensics #digital-forensics #network-forensics #legal
TCP Three-Way Handshake
#networking #TCP #handshake #transport-layer
Circumstantial Evidence
#forensics #digital-forensics #network-forensics #legal
Best Evidence
#forensics #digital-forensics #network-forensics #legal
Investigative Event Log Discovery Strategy
#powershell #windows-event-logs #digital-forensics #investigation-strategy
PowerShell Get-Help Parameter Discovery
#powershell #get-help #cmdlet-discovery #digital-forensics
PowerShell Custom Objects
#powershell #objects #json #custom-objects
Select-Object
#powershell #select-object #pipeline #properties
PowerShell ForEach-Object CmdLet
#powershell #foreach-object #pipeline #cmdlet
Inspecting .NET Classes from PowerShell
#powershell #.net #reflection #discovery
PowerShell Network Configuration CmdLets
#powershell #networking #cmdlet #digital-forensics
Baseline in Digital Forensics
#forensics #baseline #powershell #investigation
Hypothesis-Driven Analytical Investigation
#forensics #investigation #methodology #critical-thinking
Winsock fd_set Structure 0x104 Signature
#windows #winsock #reverse-engineering #x86
Debugger attach and ASLR rebasing pitfalls
#reverse-engineering #debugging #aslr #binary-ninja
Convergent vs Divergent Thinking in DFIR
#DFIR #PowerShell #event-logs #investigation
Firewall Service Filter
#powershell #firewall #windows #network-security
Get-Member CmdLet
#powershell #cmdlet #investigation #pipeline
Designing Python Scripts for Automation and Pipelines
#python #automation #pipelines #scripting

2026-09-20 12:46 #powershell #forensics #event-logs #windows #chethosmer

PowerShell provides built-in EventLog cmdlets for collecting and inspecting Windows event logs. The most commonly used cmdlet is Get-EventLog, which retrieves events from local logs such as Application, System, Security, etc.

Key cmdlets

Get-EventLog – read events from a specific log
Other related cmdlets can be found with Get-Help *EventLog

Common usage

Get-EventLog -LogName Application -Newest 20
Get-EventLog -LogName System      -Newest 20
Get-EventLog -LogName Security    -Newest 20

Accessing the Security log typically requires administrative privileges.

Why it matters in digital investigations

Event logs are a primary source of Digital Evidence for user activity, system changes, errors, and security events. PowerShell's built-in event log cmdlets allow investigators to query these logs programmatically and efficiently (see PowerShell as an Acquisition Engine).