Windows Event Logs

System-generated records of activities (e.g., logins, errors), parsed in forensics to reconstruct events, detect intrusions, or verify user actions.