Page 1

WEB & APPLICATIONLOGS · A GUIDE FOR UK LAWYERS Website, Web Server and Application Logs Request Trails, User Journeys and Proving What Happened on a Website COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM USER-JOURNEY RECONSTRUCTION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the site remembers every request 03 The log estate: servers, applications, CDNs and analytics 04 Reconstructing journeys: sessions, clicks and transactions 05 Proving page state: what the site showed and when 06 Attribution: IP, account, device, human 07 Retention, collection and the preservation race 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: LAYEREDLOGSRECONSTRUCTWHATAUSERDID; PAGE - STATE PROOFANDATTRIBUTIONDECIDEWHATITMEANS

§ 02 · FIRST PRINCIPLES The problem in plain English: the site remembers every request

§ 03 · THEESTATE The log estate: servers, applications, CDNs and analytics