SUM
SUM Database
- 1 path
- Version 1.1
- Andrew Rathbun, Yogesh Khatri
Paths on disk
1 path
Notes
LogFiles.tkape Target acquires this as well, but this is a more specific Target in that it ONLY grabs the SUM Database artifacts and nothing else, unlike LogFiles.tkape
References
6 links
- advisory.kpmg.us/blog/2021/digital-forensics-incident-response.html(opens in new tab)
- svch0st.medium.com/windows-user-access-logs-ual-9580f1100635(opens in new tab)
- github.com/EricZimmerman/Sum%20-%20be%20sure%20to%20follow%20the%20guide%20here%20for%20repairing%20the%20DB%20prior%20to%20parsing(opens in new tab)
- github.com/brimorlabs/KStrike(opens in new tab)
- docs.microsoft.com/en-us/windows-server/administration/user-access-logging/manage-user-access-logging(opens in new tab)
- thedfirspot.com/post/sum-ual-investigating-server-access-with-user-access-logging(opens in new tab)