Comparative analysis of security event audit tools using the example of access to objects in WINDOWS and LINUX OS at the initial stage of IT forensics

The article provides a comparative analysis of tools for auditing access to objects in Windows and Linux OS for IT forensics tasks. The study highlights the differences in approaches to monitoring security events: Windows (security log, Sysmon, GPO) provides ease of configuration, but is limited by the load, while Linux (auditd) provides detail at the level of system calls, requiring expert knowledge. The results showed that Linux is more effective for investigations due to the depth of data, while Windows simplifies management through graphical interfaces. Integration of tools with SIEM systems for hybrid environments is proposed.