For this reason, the importance of Log management is to aggregate logs from the endpoint (and other devices), to be integrated into devices such as Log management or SIEM, so that when there is removal of tracks or covering tracks from the threat actors who wiped from this log, investigators still can analyze the logs that have been aggregated to the SIEM / Log Management device. Digital forensic investigators will look at activities before a security incident happens to see what activities involve the threat actor and then collect the evidence.īut there is a condition when the digital forensic investigator is conducting an analysis, they will find a situation where threat actors have deleted or wiped the log to eliminate the tracks (covering tracks).

Usually the method used by a digital forensic investigator is similar to what a detective does when doing in a crime scene. Basically when an investigator doing the investigation in a security incident, the most frequently asked question is whether the log is still available, and if the answer is yes, what logs can be obtained from the system?įrom the log file in general, an investigator will see an overview of the timeline of activities and events that occured on the endpoint side during the incident. Log analysis from the endpoint side, can be in the form of event log from the operating system, log from the application, log from the database, and others. Logs from the Endpoint side (Server, Desktop, etc)įor this article, I will focus on log from the endpoint perspective.Logs from Network Devices and Security Devices (Routers, Switches, IDS, Firewalls, Proxies, NGFW, WAF, etc).

In the case of log analysis, I group them into 2 main categories for log analysis which can be explored by a forensic investigator : In this article, I will emphasize more on how to utilize log analysis for investigative purposes in digital forensic cases. Log Analysis for Digital Forensic Investigation a.

Read nimbuzz chat log forensics