Every system connected to a network keeps a diary of what happens: who connected, from where, at what time, what they requested and with what result. These diaries are logs. In a digital investigation they are often the only source that documents an event from the outside, without depending on the user's device. Knowing how to preserve and read them is a core skill in network forensics.
Which logs exist
| Source | What it records | Example of use |
|---|---|---|
| Web server | Page requests, IP, time, result, declared browser | Reconstructing an attack on a website |
| Firewall | Allowed and blocked connections | Spotting traffic to suspicious addresses |
| Router and Wi-Fi | Connected devices, assigned addresses | Finding which device was on the network |
| Mail server | Sending, receiving, mailbox logins | Checking delivery of a message |
| VPN and remote access | Sessions, users, duration | Establishing who connected from outside |
| Cloud services | Logins, changes, sharing | Finding who downloaded a document |
| DNS | Domain names requested | Spotting communication with malicious servers |
The first problem: retention
Logs are short-lived. Many devices keep only the last few days or a fixed number of lines, then overwrite. Some online services keep sign-in logs for limited periods that vary with the subscription plan. Home routers and small firewalls often lose everything on restart.
When an incident is suspected, the priority is to export the logs before they disappear. In a well-prepared organisation, logs are sent in real time to a centralised, protected system, where they cannot be altered by whoever compromised a single server.
How they are acquired
- Export the log files in their original format, not as printouts or screenshots.
- Record which system they came from, which account exported them and when.
- Note the time zone and any clock drift on the system.
- Calculate the hash of each exported file.
- Work on copies and keep the originals.
For cloud services, many platforms offer a function to export audit logs from the administration console. It should be used with the administrator account and documented like any other acquisition.
Reading a log
A web server log line, for example, usually contains the client's IP address, date and time, the method and resource requested, the response code, the size and often the declared browser. On its own it says little. Value emerges when you look at sequences:
- many rapid requests to login pages with failed results indicate an attempt to guess passwords;
- requests to non-existent paths named like configuration files suggest an automated scan looking for vulnerabilities;
- a successful login followed by requests to admin pages from a never-before-seen address deserves a closer look;
- transfers of unusual size may indicate data exfiltration.
Correlating different sources
The strength of log analysis is correlation. The same event leaves traces in several systems: the VPN login, the address assigned by the server, the connections recorded by the firewall, the requests to the file server. By aligning times to a single time zone, you can reconstruct the path of the user or attacker inside the network.
Reliable correlation needs synchronised clocks. Systems whose times differ by even a few minutes make reconstruction uncertain. That is why automatic time synchronisation on all devices is a simple but valuable measure.
The limits of an IP address
An IP address is often treated as an identity, but it is not one. Some reasons:
- sharing: many users of a mobile operator or a corporate network may reach the internet through the same public address;
- dynamic assignment: the same address is assigned to different users at different times; to know who was using it you need the exact time, including seconds, and the port when the address is shared;
- intermediaries: VPNs, proxies and anonymity networks show the intermediary's address, not the user's;
- approximate location: IP geolocation services often indicate only the provider's country or city, sometimes wrongly.
An IP therefore indicates an exit point on the network at a given moment. Tracing it to a subscriber requires the connectivity provider's data, obtainable only through the channels provided by law.
Log integrity
Whoever compromises a system may try to delete or alter local logs. Typical signs are time gaps, zeroed log files and interruptions of the logging service. A log sent to an external system remains the most reliable source precisely because it is out of the attacker's reach.
In short
- Logs document events from outside the user's device.
- They are short-lived: export them immediately in original format, with hashes.
- Value emerges from sequences and from correlation between sources.
- Synchronised clocks are essential for reliable reconstruction.
- An IP address indicates an exit point, not a person.