Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20106

General Discussion: setupapi.dev.log query

$
0
0
I'm looking at an image of a Win7 Enterprise SP1 system, setupapi.dev.log is 593KB First entry = Feb 25th 2014 @ 05:39:36.906 Last entry is = Mar 7th 2014 (employee's last day with company) There is also a file called setupapi.dev.20140225_053923.log, size = 16,454KB First entry = 11th Oct 2012 Last entry = begins 25th Feb 2014 @ 05:39:23.736 but has no "<<< Section end" or "<<< Exit Status" lines Viewed in Notepad, the end of the latter file is a blank "dvi:" line followed by a new line Viewed in Notepad++, the last "dvi:" is followed by many Null icons I remember XP renaming setupapi.log and creating a new one (once it got to circa 1MB?) but haven't come across this behaviour in Win7 before Have done some searching here and Google, saw that David Cowan had noticed the same but didn't find any follow-up, also that David Nides had done similar but again didn't find any follow-up Anyone know of a place to read up on this? Cheers

Viewing all articles
Browse latest Browse all 20106

Trending Articles