windows3-6  Exercise 2: Will the Evidence Survive?
=================================================================

Verification: Level 1 (run on the author's machine, read-only, no administrator rights).

Prediction (work this out before running the script):

  Before running: guess whether your System log is full and how far back it goes.

Command (evidence_check.ps1 saved in the current folder):

  .\evidence_check.ps1

Output (real, from the author's machine on 2026-10-24; your numbers will differ):

  1. System log      : 20.0 of 20 MB used, oldest event 2026-07-21 (96 days of history)
  2. Dump type       : Small memory dump (CrashDumpEnabled = 3)
  3. Auto restart    : 1   (1 = Windows restarts at once, so you may never see the stop code on screen)
  4. Minidumps       : 2 file(s), 7.2 MB in total
  5. MEMORY.DMP      : absent
  6. Free on C:      : 580 GB

WHY THIS WORKS AS AN ANSWER
---------------------------
  The System log is at its 20 MB maximum (20.0 of 20), so it is circular: new events overwrite the oldest
  (the oldest is 21 July, 96 days). The thing most likely to destroy the evidence is the log filling: the
  24 July restart will disappear first. Two other risks: the dump type is Small, which keeps less than a Kernel or
  Automatic dump, and automatic restart is on (1), so the stop code may never be seen on screen.
  What to do about it (not run here; each changes a setting, so write the undo first as in chapter 5): save a copy of the
  events now (save_evidence.ps1 does this), and consider a bigger System log maximum in Event Viewer's log
  properties, since 580 GB is free on C:.
  Common mistakes: assuming the log goes back as far as you need; forgetting that the stop code may never be
  displayed; and changing log or dump settings without recording the old values.