Performing Log Analysis for Forensic Investigation

When to Use

• When reconstructing the timeline of a security incident from available log sources
• During post-breach investigation to identify initial access, lateral movement, and exfiltration
• When correlating events across multiple systems and log sources
• For establishing evidence of unauthorized access or policy violations
• When preparing forensic reports requiring detailed event chronology

Prerequisites

• Access to collected log files (Windows Event Logs, syslog, application logs)
• Log parsing tools (LogParser, jq, awk, or ELK stack)
• Understanding of log formats (EVTX, syslog, JSON, CSV)
• NTP-synchronized timestamps across all log sources for correlation
• Sufficient storage for log aggregation and indexing
• Timeline analysis tools (log2timeline, Plaso)

Workflow

Step 1: Collect and Preserve Log Sources

# Create case log directory structure
mkdir -p /cases/case-2024-001/logs/{windows,linux,network,application,web}

# Extract Windows Event Logs from forensic image
cp /mnt/evidence/Windows/System32/winevt/Logs/*.evtx /cases/case-2024-001/logs/windows/

# Key Windows Event Logs to collect
# Se…