Website Web Server And Application Logs

WEB & APPLICATIONLOGS · AGUIDEFORUKLAWYERS Website, Web Server and Application Logs Request Trails, User Journeys and Proving What Happened on a Website COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM USER-JOURNEY RECONSTRUCTION CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the site remembers every request 03 The log estate: servers, applications, CDNs and analytics 04 Reconstructing journeys: sessions, clicks and transactions 05 Proving page state: what the site showed and when 06 Attribution: IP, account, device, human 07 Retention, collection and the preservation race 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : LAYEREDLOGSRECONSTRUCTWHATAUSERDID ; PAGE - STATE PROOFANDATTRIBUTIONDECIDEWHATITMEANS § 0 2 · FIRSTPRINCIPLES The problem in plain English: the site remembers every request § 0 3 · THEESTATE The log estate: servers, applications, CDNs and analytics § 0 4 · THEJOURNEY Reconstructing journeys: sessions, clicks and transactions § 0 5 · THESCREEN Proving page state: what the site showed and when § 0 6 · WHO Attribution: IP, account, device, human § 0 7 · BEFOREROTATION Retention, collection and the preservation race § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE BROWSER / SERVER WAF DATABASE IDENTIT Y RECOVERABLE USER'S DEVICE § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THESURCHARGETHECHECKOUTNEVERSERVED EXAMPLE2 · THEREVIEWCAMPAIGNWITHONEFINGERPRINT EXAMPLE3 · THETAKEOVERDEFENCE , TESTEDANDUPHELD § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · WEB - LOGLIMBFORTHEPRESER VAT IONLETTER § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The web-log checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions How long do websites keep their logs? Can logs prove someone read the terms and conditions? We only have an IP address for the wrongdoer. Is that enough? The defendant says their account was hacked. Now what? Is a Wayback Machine capture admissible to show what a page said? Can we get the other side's server logs in disclosure? § 1 4 · REFERENCE Glossary CDN CGNAT WAF Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY