Collect an AV Incident Evidence Bundle on Windows

Collect a small incident bundle that includes the reproduction time, application evidence, relevant Windows event exports and configuration identity. Preserve original files before restarting or changing the system. A screenshot saying “device offline” is rarely enough to distinguish an application error, network interruption, power event or wrong equipment address.

Write the incident note first

Record what the operator did, which physical device should have responded and what actually happened. Include local time with timezone offset, controller identity, application version and the last known successful action. If the failure is intermittent, say how often it occurred and how many attempts were observed rather than presenting an unsupported reliability percentage.

Microsoft's Windows Event Log overview describes the operating system event infrastructure. It does not imply that every controller writes its own protocol transactions there. Locate application logs through the product's documented support path and keep them separate from Windows events.

Export without clearing

Create an approved support folder and export relevant channels through Event Viewer or the documented wevtutil command. These illustrative commands require an existing destination folder and suitable permissions:

wevtutil epl System C:\AVSupport\System.evtx
wevtutil epl Application C:\AVSupport\Application.evtx

Use a new incident folder to avoid overwriting earlier evidence. Do not clear event channels as part of collection. If the logs are large, retain an original export and create a filtered working view for the relevant time interval. Avoid enabling verbose logging indefinitely without considering disk usage.

Align timestamps before drawing a timeline

Check the controller's clock source and timezone. Microsoft's Windows Time tools provide status information. If the projector or gateway clock differs, record that offset in the incident note instead of silently shifting timestamps.

A sequence of events near the same time does not prove which event caused the failure. For example, an application reconnect may follow a switch restart, but it could also be an independent idle timeout. Preserve enough context around the incident to compare alternatives.

Package only useful, permitted data

Add a file index naming each collected item, its source machine, collection time and whether it is an original or redacted copy. Include the reproduction note even when the fault cannot be repeated. An explicit statement that no packet capture was available is more useful than an unexplained empty folder.

• Copy the application evidence through its supported export method.

• Add relevant event exports and a short reproduction note.

• Include device models, firmware and current network or COM mapping.

• Identify the active configuration version without publishing secrets.

• Add a narrowly scoped packet capture only when authorized and necessary.

• Transfer the bundle using the venue's approved secure channel.

Logs and captures can contain names, addresses, credentials or customer content. Restrict bundle access and follow the venue's retention policy. If redaction is necessary, keep the original protected and label the working copy so investigators know what changed.

Accept the evidence bundle when another technician can identify the failing transaction, locate its time window and see the relevant versions without guessing. State any missing observation point or unavailable application log explicitly. Add the collection procedure to the AV commissioning checklist, and use one transaction capture when packet evidence is needed.