Skip to main content
DFIRHub
  • Artifacts
  • Collections
  • Registry
  • Event logs
  • Builder
  • Converter

Navigate

ArtifactsCollectionsRegistryEvent logsBuilderConverter
GitHub(opens in new tab)
  1. Home
  2. /Event logs
  3. /1005

Windows event logEvent ID 1005

2 event logs use this ID, and it means a different thing in each one. Pick the log you have.

Logs with event ID 1005

2 channels

  • Microsoft-Windows-Windows Defender/OperationalError - An antimalware scan failedMicrosoft-Windows-Windows Defender%4Operational.evtx
  • Microsoft-Windows-WPD-MTPClassDriver/Operational(Mobile) MTP ConnectionMicrosoft-Windows-WPD-MTPClassDriver%4Operational.evtx
DFIRHub

Free reference for Windows forensic artifacts. Find where the evidence lives and generate collection scripts for DFIR investigations.

Navigate

All ArtifactsCollectionsRegistry ArtifactsEvent LogsCommand BuilderSigma Converter

Resources

GitHub(opens in new tab)KapeFiles(opens in new tab)KAPE Documentation(opens in new tab)SANS KAPE(opens in new tab)

© 2026 DFIRHub. Data sourced from KapeFiles, EvtxECmd and RECmd