Question: One of my clients' friends suffered a hack-attack this morning due to an insecure Remote Desktop configuration and I was asked to take a look. (All of their business files were encrypted by the 2018-Q1 strain of the Dharma ransomware).

Fortunately the Windows Event Logs were not tampered with and after looking at each log individually (Application, Security, System, etc) I was able to piece-together a timeline of the attack: indicting when and how the attacker connected to the machine, installed their malware, I saw Windows Services being stopped or crashed, and then they disconnected.

In Windows XP and earlier there were only the Application, System and Security logs to go through, but since Windows Vista there are application-specific logs located under the "Applications and Services Logs" tree-view node, and with each new Windows release there are more and more new logs to examine - unfortunately you have to go through them manually: there doesn't seem to be any kind of way of selecting data from all of those logs and then applying a date/time range filter or doing a textual search.

...or is there?

(I know you can create a custom log view in Event Viewer, but it isn't easy to add another log to the search and it's very slow, in fact the entire Event Viewer UI is painfully slow, laggy and awkward since its redesign in Windows Vista). It even advises you from creating a view that references more than 10 logs:

> 
> The filter or custom view you are creating references more than 10 event logs. The result might perform poorly and consume a large amount of memory or processor time. Do you want to continue?
> 
> 
> 

In fact, when I created a view just now that referenced every Log on my computer it caused Event Viewer to lock-up and freeze and then eventually display zero items - so I guess that's just completely broken.

Is there a PowerShell command I could run to dump all events from all logs between two giving timestamps?

Answer: 
Its plausible you've got a filesystem mounted over the top of of a directory that contains the used space. I.E /tmp or /var/tmp.

Could you try outputting the result of `cat /proc/self/mounts`?

You could try mounting the root filesystem again in a new path such that there is no filesystems over the top of it.

```
$ mkdir /tmp/tmproot
$ mount /dev/mapper/cl-root /tmp/tmproot
$# Do this to find largest single directories and descend down..
$ du -h --max-depth=1 -x /tmp/tmproot | sort -h
...
$ umount /tmp/tmproot
$ rmdir /tmp/tmproot

```

Alternatively it is plausible the filesystem is damaged in some way and has consumed used inodes without removing the underlying file. I dont know how that logically works between filesystems though.

Hopefully mounting the filesystem in its 'pristine' state may reveal where the files are hidden.
Simple way to check for lost space.

1. Reboot. On unices file removed is not deleted from the disk or
caches until it's closed by all processes. If you know who can work
with huge files - restart that process. Check for free space
changes.
2. When that doesn't help try `du -hs /path/*` to get the list of huge
folders. Not always the biggest file is the source of problem, but a
few thousands smaller files can be.