performing-log-analysis-for-forensic-investigation

# Performing Log Analysis for Forensic Investigation ## When to Use - When reconstructing the timeline of a security incident from available log sources - During post-breach investigation to identify initial access, lateral movement, and exfiltration - When correlating events across multiple systems and log sources - For establishing evidence of unauthorized access or policy violations - When preparing forensic reports requiring detailed event chronology ## Prerequisites - Access to collected log files (Windows Event Logs, syslog, application logs) - Log parsing tools (LogParser, jq, awk, or ELK stack) - Understanding of log formats (EVTX, syslog, JSON, CSV) - NTP-synchronized timestamps across all log sources for correlation - Sufficient storage for log aggregation and indexing - Timeline analysis tools (log2timeline, Plaso) ## Workflow ### Step 1: Collect and Preserve Log Sources ```bash # Create case log directory structure mkdir -p /cases/case-2024-001/logs/{windows,linux,network,application,web} # Extract Windows Event Logs from forensic image cp /mnt/evidence/Windows/System32/winevt/Logs/*.evtx /cases/case-2024-001/logs/windows/ # Key Windows Event Logs to collect # Security.evtx - Authentication, access control, policy changes # System.evtx - Service starts/stops, driver loads, system errors # Application.evtx - Application errors and events # Microsoft-Windows-PowerShell%4Operational.evtx - PowerShell execution # Microsoft-Windows-Sysmon%4Operational.evtx - Sys...