Figure 11.2 WinZapper tool lets an attacker selectively delete
events from Windows NT/2000 event logs