Figure 11.2 WinZapper tool lets an attacker selectively delete events from Windows NT/2000 event logs