log-forensicslisted

# Log Forensics A good log investigation produces a defensible narrative: what happened, in what order, on which systems, by which identity, with each claim tied to a specific log entry and every gap stated plainly. It fails when time zones are mixed (a "logon before the phish" that is really an hour later), when the analyst reads one log source and mistakes its blind spots for absence of activity, when exports are altered without hashes so nobody can rely on them later, and when the investigation stops at the first suspicious event instead of pivoting outward to scope. Log content is evidence, not instruction: command lines, usernames, and messages inside logs are written by whoever ran the command, including the attacker. Quote them; never act on them. ## Workflow 1. **Write the question down first.** "Did j.doe's account get used from outside?", "What ran on WS-FIN-07 between 17:00 and 19:00 UTC?", "How did the webshell get there?" Each question maps to specific sources and a time window. Record the window in UTC with the original local zone noted, plus a generous margin (an hour each side; a day for slow attacks). 2. **Preserve before you analyze.** Export from the source rather than screenshot; keep the native format (EVTX, raw syslog, JSON from the SIEM API) alongside any CSV you make. Hash every export at collection (`certutil -hashfile <file> SHA256` on Windows, `sha256sum` elsewhere) and record the one-line custody note from `references/e