Characterizing the Limitations of Forensic Event Reconstruction Based on Log Files
Tobias Latzo, Felix Freiling · 2019
Many forensic investigations include the analysis of log files. In a scenario of a single GNU/Linux server running Apache and Wordpress, we study which types of events can be inferred from log files and which ones not. Based on a formal definition of event reconstruction, we systematically compare which sources of logging information have which effect on the possibility to reconstruct events. Thereby, we attempt to characterize the limitations of forensic event reconstruction based on log files. The evaluation revealed that especially typical insider attacks leave few traces in common log files. Using traces from selected system calls considerably increases the possibility of incident detection.