{"id":57,"date":"2021-09-17T18:28:30","date_gmt":"2021-09-17T18:28:30","guid":{"rendered":"https:\/\/forensics.cyber-kill-chain.ch\/wp\/?page_id=57"},"modified":"2022-01-28T15:49:39","modified_gmt":"2022-01-28T15:49:39","slug":"log-files","status":"publish","type":"page","link":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/log-files\/","title":{"rendered":"Log Files"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"57\" class=\"elementor elementor-57\" data-elementor-settings=\"[]\">\n\t\t\t\t\t\t\t<div class=\"elementor-section-wrap\">\n\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-e0d0544 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"e0d0544\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-f591cbc\" data-id=\"f591cbc\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-b79c987 elementor-widget elementor-widget-spacer\" data-id=\"b79c987\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0359e77 elementor-widget elementor-widget-heading\" data-id=\"0359e77\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.5.4 - 23-01-2022 *\/\n.elementor-heading-title{padding:0;margin:0;line-height:1}.elementor-widget-heading .elementor-heading-title[class*=elementor-size-]>a{color:inherit;font-size:inherit;line-height:inherit}.elementor-widget-heading .elementor-heading-title.elementor-size-small{font-size:15px}.elementor-widget-heading .elementor-heading-title.elementor-size-medium{font-size:19px}.elementor-widget-heading .elementor-heading-title.elementor-size-large{font-size:29px}.elementor-widget-heading .elementor-heading-title.elementor-size-xl{font-size:39px}.elementor-widget-heading .elementor-heading-title.elementor-size-xxl{font-size:59px}<\/style><h1 class=\"elementor-heading-title elementor-size-default\">Log Files<\/h1>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-3d95e6d elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"3d95e6d\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-9b35217\" data-id=\"9b35217\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-7c6a47a elementor-widget elementor-widget-heading\" data-id=\"7c6a47a\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Definition und Begriff<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5ca7d2b elementor-widget elementor-widget-text-editor\" data-id=\"5ca7d2b\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.5.4 - 23-01-2022 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p>Logdateien sind fortlaufende Protokolle von Ereignissen. Die Ereignisse werden mit unterschiedlicher Detailtiefe dokumentiert. H\u00e4ufig referenzieren Log Files auf Prozesse, die das Ereignis ausgel\u00f6st oder selbst in die Protokolldatei geschrieben haben. Ebenso wird regelm\u00e4ssig ein Zeitstempel hinzugef\u00fcgt. Dieser Zeitstempel basiert h\u00e4ufig auf der sog. &#8220;Unix epoch&#8221;, wobei es sich um die Anzahl Sekunden seit Mitternacht des 01.01.1970 (UTC\/GMT) handelt.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7501c25 elementor-widget elementor-widget-text-editor\" data-id=\"7501c25\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p><span style=\"text-decoration: underline;\">Synonyme benutzte Begriffe:<\/span> Protokolldatei, Ereignisprotokoll, Eventlog, log file, log.<\/p>\t\t\t\t<style>\/*! elementor - v3.5.4 - 23-01-2022 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b8ea7fc elementor-widget elementor-widget-spacer\" data-id=\"b8ea7fc\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0c1a6ee elementor-widget elementor-widget-heading\" data-id=\"0c1a6ee\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Praktische Relevanz<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-267a2b7 elementor-widget elementor-widget-text-editor\" data-id=\"267a2b7\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Logdateien sind ein zentrales Beweismittel. Nahezu jedes Ger\u00e4t f\u00fchrt irgendeine Art von Logdatei. Logging-Facilities m\u00fcssen mit besonderer Sorgfalt konfiguriert, verwaltet, gesichert und die von ihnen generierten Logfiles sicher verwahrt werden.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-95f2a65 elementor-widget elementor-widget-text-editor\" data-id=\"95f2a65\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>In der Praxis zeigt sich, dass in vielen Unternehmen Defizite bei der Inventarisierung und Dokumentation ihrer Systeme bestehen und nicht resp. nicht gen\u00fcgend bekannt ist, wo welche Logfiles mit welchem Inhalt generiert werden.<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fe1b739 elementor-widget elementor-widget-spacer\" data-id=\"fe1b739\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f39ed9a elementor-widget elementor-widget-heading\" data-id=\"f39ed9a\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Fundorte<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-970a0f0 elementor-widget elementor-widget-text-editor\" data-id=\"970a0f0\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\tNamentlich auf folgenden Ger\u00e4ten muss nach Log Files gesucht werden:\n<ul>\n \t<li>Desktop Computer (siehe auch <a href=\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/hids-host\/\" target=\"_blank\" rel=\"noopener\">HIDS\/Host<\/a>),<\/li>\n \t<li>Mobile Computers,<\/li>\n \t<li>Server,<\/li>\n \t<li><a href=\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/nids-network\/\" target=\"_blank\" rel=\"noopener\">NIDS<\/a>,<\/li>\n \t<li><a href=\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/mobile-devices\/\" target=\"_blank\" rel=\"noopener\">Fahr- und Flugzeuge<\/a>,<\/li>\n \t<li><a href=\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/mobile-devices\/\" target=\"_blank\" rel=\"noopener\">Smartphones<\/a><span class=\"footnote_referrer\"><a role=\"button\" tabindex=\"0\" onclick=\"footnote_moveToReference_1440_1('footnote_plugin_reference_1440_1_1');\" onkeypress=\"footnote_moveToReference_1440_1('footnote_plugin_reference_1440_1_1');\" ><sup id=\"footnote_plugin_tooltip_1440_1_1\" class=\"footnote_plugin_tooltip_text\">1<\/sup><\/a><span id=\"footnote_plugin_tooltip_text_1440_1_1\" class=\"footnote_tooltip\">Siehe zum Ganzen ausf\u00fchrlich Bommisetty\/Tamma\/Mahalik f\u00fcr iOS bis iPhone 4 (S. 27 ff.), f\u00fcr Android bis v. 4.4 (S. 159 ff.), f\u00fcr Windows Phone bis v. 7(S. 255 ff.) sowie Blackberry bis v. 10.2(S.&nbsp;&#x2026; <span class=\"footnote_tooltip_continue\"  onclick=\"footnote_moveToReference_1440_1('footnote_plugin_reference_1440_1_1');\">Continue reading<\/span><\/span><\/span><script type=\"text\/javascript\"> jQuery('#footnote_plugin_tooltip_1440_1_1').tooltip({ tip: '#footnote_plugin_tooltip_text_1440_1_1', tipClass: 'footnote_tooltip', effect: 'fade', predelay: 0, fadeInSpeed: 200, delay: 400, fadeOutSpeed: 200, position: 'top center', relative: true, offset: [-7, 0], });<\/script>,<\/li>\n \t<li><a href=\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/operating-systems\/\" target=\"_blank\" rel=\"noopener\">Operating Systems<\/a>,<\/li>\n \t<li>Applications<span class=\"footnote_referrer\"><a role=\"button\" tabindex=\"0\" onclick=\"footnote_moveToReference_1440_1('footnote_plugin_reference_1440_1_2');\" onkeypress=\"footnote_moveToReference_1440_1('footnote_plugin_reference_1440_1_2');\" ><sup id=\"footnote_plugin_tooltip_1440_1_2\" class=\"footnote_plugin_tooltip_text\">2<\/sup><\/a><span id=\"footnote_plugin_tooltip_text_1440_1_2\" class=\"footnote_tooltip\"><span class=\"\"autor-continuous-text\"\">K\u00e4vrestad<\/span>, Fundamentals, S. 42 und beispielhaft zur Auswertung der Logs S. 146; <\/span><\/span><script type=\"text\/javascript\"> jQuery('#footnote_plugin_tooltip_1440_1_2').tooltip({ tip: '#footnote_plugin_tooltip_text_1440_1_2', tipClass: 'footnote_tooltip', effect: 'fade', predelay: 0, fadeInSpeed: 200, delay: 400, fadeOutSpeed: 200, position: 'top center', relative: true, offset: [-7, 0], });<\/script>,<\/li>\n \t<li>Browsers<span class=\"footnote_referrer\"><a role=\"button\" tabindex=\"0\" onclick=\"footnote_moveToReference_1440_1('footnote_plugin_reference_1440_1_3');\" onkeypress=\"footnote_moveToReference_1440_1('footnote_plugin_reference_1440_1_3');\" ><sup id=\"footnote_plugin_tooltip_1440_1_3\" class=\"footnote_plugin_tooltip_text\">3<\/sup><\/a><span id=\"footnote_plugin_tooltip_text_1440_1_3\" class=\"footnote_tooltip\">Obschon Browser an und f\u00fcr sich Applikationen darstellen, erhalten sie wegen ihrer herausragenden Bedeutung einen eigenen Listeneintrag. F\u00fcr Browser-Forensik siehe z.B.: Altheide\/Carvey , S. 143&nbsp;&#x2026; <span class=\"footnote_tooltip_continue\"  onclick=\"footnote_moveToReference_1440_1('footnote_plugin_reference_1440_1_3');\">Continue reading<\/span><\/span><\/span><script type=\"text\/javascript\"> jQuery('#footnote_plugin_tooltip_1440_1_3').tooltip({ tip: '#footnote_plugin_tooltip_text_1440_1_3', tipClass: 'footnote_tooltip', effect: 'fade', predelay: 0, fadeInSpeed: 200, delay: 400, fadeOutSpeed: 200, position: 'top center', relative: true, offset: [-7, 0], });<\/script>,<\/li>\n \t<li><a href=\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/perimeter-devices\/\" target=\"_blank\" rel=\"noopener\">Perimeter Devices<\/a> (Routers, Switches etc.) <span class=\"footnote_referrer\"><a role=\"button\" tabindex=\"0\" onclick=\"footnote_moveToReference_1440_1('footnote_plugin_reference_1440_1_4');\" onkeypress=\"footnote_moveToReference_1440_1('footnote_plugin_reference_1440_1_4');\" ><sup id=\"footnote_plugin_tooltip_1440_1_4\" class=\"footnote_plugin_tooltip_text\">4<\/sup><\/a><span id=\"footnote_plugin_tooltip_text_1440_1_4\" class=\"footnote_tooltip\">Namentlich f\u00fcr Router: <span class=\"\"autor-continuous-text\"\">Geschonneck<\/span>, S. 308;<\/span><\/span><script type=\"text\/javascript\"> jQuery('#footnote_plugin_tooltip_1440_1_4').tooltip({ tip: '#footnote_plugin_tooltip_text_1440_1_4', tipClass: 'footnote_tooltip', effect: 'fade', predelay: 0, fadeInSpeed: 200, delay: 400, fadeOutSpeed: 200, position: 'top center', relative: true, offset: [-7, 0], });<\/script>,<\/li>\n \t<li>IoT-Devices (Internet of Things, Smart Devices).<\/li>\n<\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9c9fbc1 elementor-widget elementor-widget-spacer\" data-id=\"9c9fbc1\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-36a53a7 elementor-widget elementor-widget-heading\" data-id=\"36a53a7\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h3 class=\"elementor-heading-title elementor-size-default\">Weit verbreitete Log File-Pfade<\/h3>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c988be0 elementor-widget elementor-widget-heading\" data-id=\"c988be0\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Linux<span class=\"footnote_referrer\"><a role=\"button\" tabindex=\"0\" onclick=\"footnote_moveToReference_1440_1('footnote_plugin_reference_1440_1_5');\" onkeypress=\"footnote_moveToReference_1440_1('footnote_plugin_reference_1440_1_5');\" ><sup id=\"footnote_plugin_tooltip_1440_1_5\" class=\"footnote_plugin_tooltip_text\">5<\/sup><\/a><span id=\"footnote_plugin_tooltip_text_1440_1_5\" class=\"footnote_tooltip\">Siehe unter anderen:  Altheide\/Carvey , S. 116; Lin, S. 306 ff.;  Messier, Network Forensics, S. 166 ff. und 212 ff.; Casey, Investigations (2003), S. 193 sowie Mohan\/Anderson\/Collie\/Del&nbsp;&#x2026; <span class=\"footnote_tooltip_continue\"  onclick=\"footnote_moveToReference_1440_1('footnote_plugin_reference_1440_1_5');\">Continue reading<\/span><\/span><\/span><script type=\"text\/javascript\"> jQuery('#footnote_plugin_tooltip_1440_1_5').tooltip({ tip: '#footnote_plugin_tooltip_text_1440_1_5', tipClass: 'footnote_tooltip', effect: 'fade', predelay: 0, fadeInSpeed: 200, delay: 400, fadeOutSpeed: 200, position: 'top center', relative: true, offset: [-7, 0], });<\/script><\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b208667 elementor-widget elementor-widget-text-editor\" data-id=\"b208667\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul><li>\/var\/log\/kern<\/li><li>\/var\/log\/message<\/li><li>\/var\/log\/auth.log<\/li><li>\/var\/log\/syslog<\/li><li>Journald-Journale<\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f1cb6b6 elementor-widget elementor-widget-spacer\" data-id=\"f1cb6b6\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e8617d5 elementor-widget elementor-widget-heading\" data-id=\"e8617d5\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Windows<span class=\"footnote_referrer\"><a role=\"button\" tabindex=\"0\" onclick=\"footnote_moveToReference_1440_1('footnote_plugin_reference_1440_1_6');\" onkeypress=\"footnote_moveToReference_1440_1('footnote_plugin_reference_1440_1_6');\" ><sup id=\"footnote_plugin_tooltip_1440_1_6\" class=\"footnote_plugin_tooltip_text\">6<\/sup><\/a><span id=\"footnote_plugin_tooltip_text_1440_1_6\" class=\"footnote_tooltip\">Siehe unter anderem:\n\n <span class=\"\" autor-continuous-text\"\"=\"\">Altheide\/Carvey <\/span>, S. 84;  <span class=\"\" autor-continuous-text\"\"=\"\">Hassan<\/span>, S. 226;  <span class=\"\" autor-continuous-text\"\"=\"\">K\u00e4vrestad<\/span>, Fundamentals, S. 39 f.; <span class=\"\" autor-continuous-text\"\"=\"\">Messier<\/span>, Network Forensics, S. 224 ff.; <span class=\"\" autor-continuous-text\"\"=\"\">Lin<\/span>, S. 310 ff.<\/span><\/span><script type=\"text\/javascript\"> jQuery('#footnote_plugin_tooltip_1440_1_6').tooltip({ tip: '#footnote_plugin_tooltip_text_1440_1_6', tipClass: 'footnote_tooltip', effect: 'fade', predelay: 0, fadeInSpeed: 200, delay: 400, fadeOutSpeed: 200, position: 'top center', relative: true, offset: [-7, 0], });<\/script><\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c89dc9f elementor-widget elementor-widget-text-editor\" data-id=\"c89dc9f\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Unter Windows finden sich die Log Files des Windows Event Viewers unter &#8220;\\Windows\\System32\\winevt\\Logs\\&#8221;. <\/p><p>Weitere Logs finden sich unter &#8220;Windows\\System32\\LogFiles&#8221;<\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-92925d4 elementor-widget elementor-widget-text-editor\" data-id=\"92925d4\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Windows Event Viewer:<\/p><ul class=\"\"><li id=\"eb33\" class=\"hy hz dm ia b ib iu hf id ie iv hj ig ih iw ij ik il ix in io ip iy ir is it iz ja jb ej\" data-selectable-paragraph=\"\">Application logs,<\/li><li id=\"d314\" class=\"hy hz dm ia b ib jc hf id ie jd hj ig ih je ij ik il jf in io ip jg ir is it iz ja jb ej\" data-selectable-paragraph=\"\">Security logs,<\/li><li id=\"51cf\" class=\"hy hz dm ia b ib jc hf id ie jd hj ig ih je ij ik il jf in io ip jg ir is it iz ja jb ej\" data-selectable-paragraph=\"\">System logs.<\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d929de5 elementor-widget elementor-widget-spacer\" data-id=\"d929de5\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8fd4cc7 elementor-widget elementor-widget-heading\" data-id=\"8fd4cc7\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">Mac OS<span class=\"footnote_referrer\"><a role=\"button\" tabindex=\"0\" onclick=\"footnote_moveToReference_1440_1('footnote_plugin_reference_1440_1_7');\" onkeypress=\"footnote_moveToReference_1440_1('footnote_plugin_reference_1440_1_7');\" ><sup id=\"footnote_plugin_tooltip_1440_1_7\" class=\"footnote_plugin_tooltip_text\">7<\/sup><\/a><span id=\"footnote_plugin_tooltip_text_1440_1_7\" class=\"footnote_tooltip\">Siehe unter anderem:  <span class=\"\" autor-continuous-text\"\"=\"\">Altheide\/Carvey <\/span>, S. 133;  <span class=\"\" autor-continuous-text\"\"=\"\">Messier<\/span>, Network Forensics, S. 166 ff. und 212 ff.<\/span><\/span><script type=\"text\/javascript\"> jQuery('#footnote_plugin_tooltip_1440_1_7').tooltip({ tip: '#footnote_plugin_tooltip_text_1440_1_7', tipClass: 'footnote_tooltip', effect: 'fade', predelay: 0, fadeInSpeed: 200, delay: 400, fadeOutSpeed: 200, position: 'top center', relative: true, offset: [-7, 0], });<\/script><\/h4>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-e057ac1 elementor-widget elementor-widget-text-editor\" data-id=\"e057ac1\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Bei MacOS finden sich Log Files im benutzerspezifischen &#8220;Library\/Logs\/&#8221;-Verzeichnis, das grunds\u00e4tzlich plaintext Log Files enth\u00e4lt<\/p>\t\t\t\t<style>\/*! elementor - v3.5.4 - 23-01-2022 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-78786cd elementor-widget elementor-widget-spacer\" data-id=\"78786cd\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-b42c895 elementor-widget elementor-widget-heading\" data-id=\"b42c895\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Zentrale Logserver<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-73b76d5 elementor-widget elementor-widget-text-editor\" data-id=\"73b76d5\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\tWertvoll ist der Einsatz von zentralen Logservern<span class=\"footnote_referrer\"><a role=\"button\" tabindex=\"0\" onclick=\"footnote_moveToReference_1440_1('footnote_plugin_reference_1440_1_8');\" onkeypress=\"footnote_moveToReference_1440_1('footnote_plugin_reference_1440_1_8');\" ><sup id=\"footnote_plugin_tooltip_1440_1_8\" class=\"footnote_plugin_tooltip_text\">8<\/sup><\/a><span id=\"footnote_plugin_tooltip_text_1440_1_8\" class=\"footnote_tooltip\"><span class=\"autor-continuous-text\">Messier<\/span>, Network Forensics, S. 216.<\/span><\/span><script type=\"text\/javascript\"> jQuery('#footnote_plugin_tooltip_1440_1_8').tooltip({ tip: '#footnote_plugin_tooltip_text_1440_1_8', tipClass: 'footnote_tooltip', effect: 'fade', predelay: 0, fadeInSpeed: 200, delay: 400, fadeOutSpeed: 200, position: 'top center', relative: true, offset: [-7, 0], });<\/script>, die nur einer stark beschr\u00e4nkten Nutzergruppe zug\u00e4nglich sind; am besten ausschliesslich im Vier-Augen-Prinzip. Es sollte nicht ausschliesslich auf einen zentralen Logserver abgest\u00fctzt werden, sondern die NIDS sollten zum einen eigenst\u00e4ndig ihre Logs noch \u00fcber einen l\u00e4ngeren Zeitraum vorhalten k\u00f6nnen und zum andern sollten zentrale Logserver idealerweise Redundanzen und eine andere Lokalit\u00e4t aufweisen. Auch Logserver sollten Backuping betreiben.\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-750d36b elementor-widget elementor-widget-spacer\" data-id=\"750d36b\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7cead84 elementor-widget elementor-widget-heading\" data-id=\"7cead84\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">M\u00f6gliche Indizien aus Log Files<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-57be22f elementor-widget elementor-widget-text-editor\" data-id=\"57be22f\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<p>Die Informationen, die aus Log Files gewonnen werden k\u00f6nnen, h\u00e4ngen stark mit der Konfiguration der Log Facilites und dem Schutz der Log Files zusammen.<\/p><p>Zur Veranschaulichung werden hier einige m\u00f6gliche Erkenntnisse aus Log Files aufgef\u00fchrt:<span class=\"footnote_referrer\"><a role=\"button\" tabindex=\"0\" onclick=\"footnote_moveToReference_1440_1('footnote_plugin_reference_1440_1_9');\" onkeypress=\"footnote_moveToReference_1440_1('footnote_plugin_reference_1440_1_9');\" ><sup id=\"footnote_plugin_tooltip_1440_1_9\" class=\"footnote_plugin_tooltip_text\">9<\/sup><\/a><span id=\"footnote_plugin_tooltip_text_1440_1_9\" class=\"footnote_tooltip\">Angelehnt an <span class=\"autor-continuous-text\">Geschonneck<\/span>, S. 153 f.<\/span><\/span><script type=\"text\/javascript\"> jQuery('#footnote_plugin_tooltip_1440_1_9').tooltip({ tip: '#footnote_plugin_tooltip_text_1440_1_9', tipClass: 'footnote_tooltip', effect: 'fade', predelay: 0, fadeInSpeed: 200, delay: 400, fadeOutSpeed: 200, position: 'top center', relative: true, offset: [-7, 0], });<\/script><\/p><ul><li>Anmeldeversuche,<\/li><li>Privilege Escalations (z.B. sudo),<\/li><li>Status\u00e4nderungen von Diensten (Start, Stop, Restart etc.),<\/li><li>User Creation,<\/li><li>Prozess-Crashes, Hardware-Fehler (z.B. als Folge eines Exploits),<\/li><li>Sperrungen von Zug\u00e4ngen (Blocking, Rate Limiting)<\/li><li>Anpassungen an den Netzwerkinterface (Promiscuous Mode, Domain Name Server, Gateway, Tunnel- und Tap-Devices)<\/li><\/ul><div>\u00a0<\/div>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ac07f9a elementor-widget elementor-widget-heading\" data-id=\"ac07f9a\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Hinweise zur Beweissicherung bei Log Files<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-67d492e elementor-widget elementor-widget-text-editor\" data-id=\"67d492e\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul>\n \t<li>Die forensischen Grunds\u00e4tze gelten bei Log Files uneingeschr\u00e4nkt;<\/li>\n \t<li>Administratoren\/Owner von Log Files oder Systemen mit relevanten Log Files oder von zentralen Log Verwaltungsinstanzen d\u00fcrfen nicht die eigenen untersuchungen f\u00fchren (vgl. )<\/li>\n \t<li>Log Files m\u00fcssen in einem Kontext betrachtet und analysiert werden: Es m\u00fcssen gleichzeitig mit der Log File-Sicherung aktuelle Netzwerktopologien herausverlangt oder erstellt werden; anders lassen sich viele netzwerktechnische Sachverhalte nicht interpretieren;<\/li>\n \t<li>Verschiedene Log Files m\u00fcssen zeitlich synchronisiert werden, damit wird die zeitliche Interpretation der Vorkommnisse stark erleichtert<span class=\"footnote_referrer\"><a role=\"button\" tabindex=\"0\" onclick=\"footnote_moveToReference_1440_1('footnote_plugin_reference_1440_1_10');\" onkeypress=\"footnote_moveToReference_1440_1('footnote_plugin_reference_1440_1_10');\" ><sup id=\"footnote_plugin_tooltip_1440_1_10\" class=\"footnote_plugin_tooltip_text\">10<\/sup><\/a><span id=\"footnote_plugin_tooltip_text_1440_1_10\" class=\"footnote_tooltip\"><span class=\"\"autor-continuous-text\"\">BSI<\/span>, Leitfaden IT-Forensik, S. 203; <span class=\"\"autor-continuous-text\"\">Mohan\/Anderson\/Collie\/Del Vel\/McKemmish<\/span>, S. 84 f.<\/span><\/span><script type=\"text\/javascript\"> jQuery('#footnote_plugin_tooltip_1440_1_10').tooltip({ tip: '#footnote_plugin_tooltip_text_1440_1_10', tipClass: 'footnote_tooltip', effect: 'fade', predelay: 0, fadeInSpeed: 200, delay: 400, fadeOutSpeed: 200, position: 'top center', relative: true, offset: [-7, 0], });<\/script>;<\/li>\n \t<li> &#8230;<\/li>\n<\/ul>\n<div><\/div>\n<div><\/div>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-ca41b84\" data-id=\"ca41b84\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-220755e elementor-widget elementor-widget-page-title\" data-id=\"220755e\" data-element_type=\"widget\" data-widget_type=\"page-title.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\n\t\t<div class=\"hfe-page-title hfe-page-title-wrapper elementor-widget-heading\">\n\n\t\t\t\t\t\t\t\t<h6 class=\"elementor-heading-title elementor-size-default\">\n\t\t\t\t\t\t\t\t\n\t\t\t\t\t\t\t\t\tOverview: \t\t\t\t\tLog Files  \n\t\t\t<\/h6 > \n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6552070 elementor-widget elementor-widget-shortcode\" data-id=\"6552070\" data-element_type=\"widget\" data-widget_type=\"shortcode.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-shortcode\"><!-- Beginning of Link Library Output --><div id='linklist1' class='linklist'><!-- Div Linklist -->\n<div class=\"LinkLibraryCat LinkLibraryCat27 level0\"><!-- Div Category --><div id=\"quick-links\"><!-- Div Category Name --><div class=\"linklistcatname\"><!-- Div Cat Name --><span class=\"linklistcatclass\">Quick Links<\/span><\/div><!-- DivOrHeader --><\/div><!-- Div Category Name -->\n\t<ul>\n<li><a href=\"https:\/\/www.sans.org\/brochure\/course\/log-management-in-depth\/6\" id=\"link-2025\" class=\"track_this_link \" rel=\"noopener noreferrer\" target=\"_blank\">SANS Cheat Sheet &#8220;Log Files&#8221;<\/a>\n(<a href=\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/wp-content\/uploads\/2022\/01\/SANS-Cheat-Sheet-Log-Files.pdf\" id=\"link-2025\" class=\"track_this_link\" >Mirror<\/a>)<\/li>\n<li><a href=\"https:\/\/en.wikipedia.org\/wiki\/Logging_(software)\" id=\"link-2026\" class=\"track_this_link \" rel=\"noopener noreferrer\" target=\"_blank\">Wikipedia &#8220;Log Files&#8221;<\/a><\/li>\n\t<\/ul>\n<\/div><!-- Div End Category -->\n<script type='text\/javascript'>\njQuery(document).ready(function()\n{\njQuery('.arrow-up').hide();\njQuery('#linklist1 a.track_this_link').click(function() {\nlinkid = this.id;\nlinkid = linkid.substring(5);\npath = '';\njQuery.ajax( {    type: 'POST',    url: 'https:\/\/forensics.cyber-kill-chain.ch\/bin\/wp-admin\/admin-ajax.php',     data: { action: 'link_library_tracker',             _ajax_nonce: 'e1ebdf9706',             id:linkid, xpath:path }     });\nreturn true;\n});\njQuery('#linklist1 .expandlinks').click(function() {\ntarget = '.' + jQuery(this).attr('id');\nsubcattarget = '.' + jQuery(this).attr('data-subcat');\nif ( jQuery( target ).is(':visible') ) {\njQuery(target).slideUp();\njQuery(subcattarget).slideToggle();\njQuery(this).children('img').attr('src', 'https:\/\/forensics.cyber-kill-chain.ch\/bin\/wp-content\/plugins\/link-library\/icons\/expand-32.png');\n} else {\njQuery(target).slideDown();\njQuery(subcattarget).slideToggle();\njQuery(this).children('img').attr('src', 'https:\/\/forensics.cyber-kill-chain.ch\/bin\/wp-content\/plugins\/link-library\/icons\/collapse-32.png');\n}\n});\njQuery('#linklist1 .linklistcatclass').click(function() {\njQuery(this).siblings('.expandlinks').click();\n});\njQuery('#linklist1 .linklistcatnamedesc').click(function() {\njQuery(this).siblings('.expandlinks').click();\n});\n});\n<\/script>\n<\/div><!-- Div Linklist -->\n<!-- End of Link Library Output -->\n\n <\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9a9e8e7 elementor-widget elementor-widget-shortcode\" data-id=\"9a9e8e7\" data-element_type=\"widget\" data-widget_type=\"shortcode.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-shortcode\"><!-- Beginning of Link Library Output --><div id='linklist1' class='linklist'><!-- Div Linklist -->\n<div class=\"LinkLibraryCat LinkLibraryCat8 level0\"><!-- Div Category --><div id=\"data-sources\"><!-- Div Category Name --><div class=\"linklistcatname\"><!-- Div Cat Name --><span class=\"linklistcatclass\">Data Sources<\/span><\/div><!-- DivOrHeader --><\/div><!-- Div Category Name -->\n\t<ul>\n<li><a href=\"https:\/\/cyber-kill-chain.ch\/datasources\/DS0015\" id=\"link-1410\" class=\"track_this_link \" rel=\"noopener noreferrer\">Application Log (DS0015)<\/a><\/li>\n<li><a href=\"https:\/\/cyber-kill-chain.ch\/datasources\/DS0016\" id=\"link-1418\" class=\"track_this_link \" rel=\"noopener noreferrer\">Drive (DS0016)<\/a><\/li>\n<li><a href=\"https:\/\/cyber-kill-chain.ch\/datasources\/DS0022\" id=\"link-1420\" class=\"track_this_link \" rel=\"noopener noreferrer\">File (DS0022)<\/a><\/li>\n<li><a href=\"https:\/\/cyber-kill-chain.ch\/datasources\/DS0018\" id=\"link-1421\" class=\"track_this_link \" rel=\"noopener noreferrer\">Firewall (DS0018)<\/a><\/li>\n<li><a href=\"https:\/\/cyber-kill-chain.ch\/datasources\/DS0035\" id=\"link-1426\" class=\"track_this_link \" rel=\"noopener noreferrer\">Internet Scan (DS0035)<\/a><\/li>\n<li><a href=\"https:\/\/cyber-kill-chain.ch\/datasources\/DS0028\" id=\"link-1428\" class=\"track_this_link \" rel=\"noopener noreferrer\">Logon Session (DS0028)<\/a><\/li>\n<li><a href=\"https:\/\/cyber-kill-chain.ch\/datasources\/DS0003\" id=\"link-1437\" class=\"track_this_link \" rel=\"noopener noreferrer\">Scheduled Job (DS0003)<\/a><\/li>\n<li><a href=\"https:\/\/cyber-kill-chain.ch\/datasources\/DS0019\" id=\"link-1440\" class=\"track_this_link \" rel=\"noopener noreferrer\">Service (DS0019)<\/a><\/li>\n\t<\/ul>\n<\/div><!-- Div End Category -->\n<script type='text\/javascript'>\njQuery(document).ready(function()\n{\njQuery('.arrow-up').hide();\njQuery('#linklist1 a.track_this_link').click(function() {\nlinkid = this.id;\nlinkid = linkid.substring(5);\npath = '';\njQuery.ajax( {    type: 'POST',    url: 'https:\/\/forensics.cyber-kill-chain.ch\/bin\/wp-admin\/admin-ajax.php',     data: { action: 'link_library_tracker',             _ajax_nonce: 'e1ebdf9706',             id:linkid, xpath:path }     });\nreturn true;\n});\njQuery('#linklist1 .expandlinks').click(function() {\ntarget = '.' + jQuery(this).attr('id');\nsubcattarget = '.' + jQuery(this).attr('data-subcat');\nif ( jQuery( target ).is(':visible') ) {\njQuery(target).slideUp();\njQuery(subcattarget).slideToggle();\njQuery(this).children('img').attr('src', 'https:\/\/forensics.cyber-kill-chain.ch\/bin\/wp-content\/plugins\/link-library\/icons\/expand-32.png');\n} else {\njQuery(target).slideDown();\njQuery(subcattarget).slideToggle();\njQuery(this).children('img').attr('src', 'https:\/\/forensics.cyber-kill-chain.ch\/bin\/wp-content\/plugins\/link-library\/icons\/collapse-32.png');\n}\n});\njQuery('#linklist1 .linklistcatclass').click(function() {\njQuery(this).siblings('.expandlinks').click();\n});\njQuery('#linklist1 .linklistcatnamedesc').click(function() {\njQuery(this).siblings('.expandlinks').click();\n});\n});\n<\/script>\n<\/div><!-- Div Linklist -->\n<!-- End of Link Library Output -->\n\n<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-50aad52 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"50aad52\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-087d4ec\" data-id=\"087d4ec\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-d1e42e2 elementor-widget elementor-widget-spacer\" data-id=\"d1e42e2\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-22fd711 elementor-widget elementor-widget-heading\" data-id=\"22fd711\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Tools zur Log File-Analyse<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7d17c9e elementor-widget elementor-widget-text-editor\" data-id=\"7d17c9e\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul><li><a href=\"http:\/\/securitywarriorconsulting.com\/logtools\/\" target=\"_blank\" rel=\"noopener\">http:\/\/securitywarriorconsulting.com\/logtools\/<\/a> <\/li><li><a href=\"https:\/\/www.loganalysis.org\/log-parsing\/\" target=\"_blank\" rel=\"noopener\">https:\/\/www.loganalysis.org\/log-parsing\/<\/a><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-2496223 elementor-widget elementor-widget-text-editor\" data-id=\"2496223\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-c447211\" data-id=\"c447211\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap\">\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-a640420 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"a640420\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-b737815\" data-id=\"b737815\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-9fe3fd0 elementor-widget elementor-widget-spacer\" data-id=\"9fe3fd0\" data-element_type=\"widget\" data-widget_type=\"spacer.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-spacer\">\n\t\t\t<div class=\"elementor-spacer-inner\"><\/div>\n\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4313caf elementor-widget elementor-widget-heading\" data-id=\"4313caf\" data-element_type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Materialien<\/h2>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-650ad92 elementor-widget elementor-widget-text-editor\" data-id=\"650ad92\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<ul><li><a href=\"https:\/\/it-forensik.fiw.hs-wismar.de\/index.php\/Log-File\" target=\"_blank\" rel=\"noopener\">https:\/\/it-forensik.fiw.hs-wismar.de\/index.php\/Log-File<\/a><\/li><li><a href=\"https:\/\/forensicswiki.xyz\/page\/Windows_Event_Log_(EVT)\" target=\"_blank\" rel=\"noopener\">https:\/\/forensicswiki.xyz\/page\/Windows_Event_Log_(EVT)<\/a><\/li><li><a href=\"https:\/\/en.wikipedia.org\/wiki\/Log_analysis\" target=\"_blank\" rel=\"noopener\">https:\/\/en.wikipedia.org\/wiki\/Log_analysis<\/a><\/li><\/ul>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c3119a7 elementor-widget elementor-widget-shortcode\" data-id=\"c3119a7\" data-element_type=\"widget\" data-widget_type=\"shortcode.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"elementor-shortcode\"><div class=\"speaker-mute footnotes_reference_container\"> <div class=\"footnote_container_prepare\"><h5><span role=\"button\" tabindex=\"0\" class=\"footnote_reference_container_label pointer\" onclick=\"footnote_expand_collapse_reference_container_1440_1();\">Referenzen<\/span><span role=\"button\" tabindex=\"0\" class=\"footnote_reference_container_collapse_button\" style=\"display: none;\" onclick=\"footnote_expand_collapse_reference_container_1440_1();\">[<a id=\"footnote_reference_container_collapse_button_1440_1\">+<\/a>]<\/span><\/h5><\/div> <div id=\"footnote_references_container_1440_1\" style=\"\"><table class=\"footnotes_table footnote-reference-container\"><caption class=\"accessibility\">Referenzen<\/caption> <tbody> \r\n\r\n<tr class=\"footnotes_plugin_reference_row\"> <th scope=\"row\" class=\"footnote_plugin_index_combi pointer\"  onclick=\"footnote_moveToAnchor_1440_1('footnote_plugin_tooltip_1440_1_1');\"><a id=\"footnote_plugin_reference_1440_1_1\" class=\"footnote_backlink\"><span class=\"footnote_index_arrow\">&#8593;<\/span>1<\/a><\/th> <td class=\"footnote_plugin_text\">Siehe zum Ganzen ausf\u00fchrlich <span class=\"\"autor-continuous-text\"\">Bommisetty\/Tamma\/Mahalik<\/span> f\u00fcr iOS bis iPhone 4 (S. 27 ff.), f\u00fcr Android bis v. 4.4 (S. 159 ff.), f\u00fcr Windows Phone bis v. 7(S. 255 ff.) sowie Blackberry bis v. 10.2(S. 272 ff.) (Stand bei Publikation von <span class=\"\"autor-continuous-text\"\">Bommisetty\/Tamma\/Mahalik<\/span> im Jahr 2014); <span class=\"\"autor-continuous-text\"\">Geschonneck<\/span>, S. 292; <\/td><\/tr>\r\n\r\n<tr class=\"footnotes_plugin_reference_row\"> <th scope=\"row\" class=\"footnote_plugin_index_combi pointer\"  onclick=\"footnote_moveToAnchor_1440_1('footnote_plugin_tooltip_1440_1_2');\"><a id=\"footnote_plugin_reference_1440_1_2\" class=\"footnote_backlink\"><span class=\"footnote_index_arrow\">&#8593;<\/span>2<\/a><\/th> <td class=\"footnote_plugin_text\"><span class=\"\"autor-continuous-text\"\">K\u00e4vrestad<\/span>, Fundamentals, S. 42 und beispielhaft zur Auswertung der Logs S. 146; <\/td><\/tr>\r\n\r\n<tr class=\"footnotes_plugin_reference_row\"> <th scope=\"row\" class=\"footnote_plugin_index_combi pointer\"  onclick=\"footnote_moveToAnchor_1440_1('footnote_plugin_tooltip_1440_1_3');\"><a id=\"footnote_plugin_reference_1440_1_3\" class=\"footnote_backlink\"><span class=\"footnote_index_arrow\">&#8593;<\/span>3<\/a><\/th> <td class=\"footnote_plugin_text\">Obschon Browser an und f\u00fcr sich Applikationen darstellen, erhalten sie wegen ihrer herausragenden Bedeutung einen eigenen Listeneintrag. F\u00fcr Browser-Forensik siehe z.B.: <span class=\"\"autor-continuous-text\"\">Altheide\/Carvey <\/span>, S. 143 ff.;<\/td><\/tr>\r\n\r\n<tr class=\"footnotes_plugin_reference_row\"> <th scope=\"row\" class=\"footnote_plugin_index_combi pointer\"  onclick=\"footnote_moveToAnchor_1440_1('footnote_plugin_tooltip_1440_1_4');\"><a id=\"footnote_plugin_reference_1440_1_4\" class=\"footnote_backlink\"><span class=\"footnote_index_arrow\">&#8593;<\/span>4<\/a><\/th> <td class=\"footnote_plugin_text\">Namentlich f\u00fcr Router: <span class=\"\"autor-continuous-text\"\">Geschonneck<\/span>, S. 308;<\/td><\/tr>\r\n\r\n<tr class=\"footnotes_plugin_reference_row\"> <th scope=\"row\" class=\"footnote_plugin_index_combi pointer\"  onclick=\"footnote_moveToAnchor_1440_1('footnote_plugin_tooltip_1440_1_5');\"><a id=\"footnote_plugin_reference_1440_1_5\" class=\"footnote_backlink\"><span class=\"footnote_index_arrow\">&#8593;<\/span>5<\/a><\/th> <td class=\"footnote_plugin_text\">Siehe unter anderen:  <span class=\"\" autor-continuous-text\"\"=\"\">Altheide\/Carvey <\/span>, S. 116; <span class=\"\" autor-continuous-text\"\"=\"\">Lin<\/span>, S. 306 ff.;  <span class=\"\" autor-continuous-text\"\"=\"\">Messier<\/span>, Network Forensics, S. 166 ff. und 212 ff.; <span class=\"\" autor-continuous-text\"\"=\"\">Casey<\/span>, Investigations (2003), S. 193 sowie <span class=\"\" autor-continuous-text\"\"=\"\">Mohan\/Anderson\/Collie\/Del Vel\/McKemmish<\/span>, S. 83 (f\u00fcr historisch Interessierte)<\/td><\/tr>\r\n\r\n<tr class=\"footnotes_plugin_reference_row\"> <th scope=\"row\" class=\"footnote_plugin_index_combi pointer\"  onclick=\"footnote_moveToAnchor_1440_1('footnote_plugin_tooltip_1440_1_6');\"><a id=\"footnote_plugin_reference_1440_1_6\" class=\"footnote_backlink\"><span class=\"footnote_index_arrow\">&#8593;<\/span>6<\/a><\/th> <td class=\"footnote_plugin_text\">Siehe unter anderem:\n\n <span class=\"\" autor-continuous-text\"\"=\"\">Altheide\/Carvey <\/span>, S. 84;  <span class=\"\" autor-continuous-text\"\"=\"\">Hassan<\/span>, S. 226;  <span class=\"\" autor-continuous-text\"\"=\"\">K\u00e4vrestad<\/span>, Fundamentals, S. 39 f.; <span class=\"\" autor-continuous-text\"\"=\"\">Messier<\/span>, Network Forensics, S. 224 ff.; <span class=\"\" autor-continuous-text\"\"=\"\">Lin<\/span>, S. 310 ff.<\/td><\/tr>\r\n\r\n<tr class=\"footnotes_plugin_reference_row\"> <th scope=\"row\" class=\"footnote_plugin_index_combi pointer\"  onclick=\"footnote_moveToAnchor_1440_1('footnote_plugin_tooltip_1440_1_7');\"><a id=\"footnote_plugin_reference_1440_1_7\" class=\"footnote_backlink\"><span class=\"footnote_index_arrow\">&#8593;<\/span>7<\/a><\/th> <td class=\"footnote_plugin_text\">Siehe unter anderem:  <span class=\"\" autor-continuous-text\"\"=\"\">Altheide\/Carvey <\/span>, S. 133;  <span class=\"\" autor-continuous-text\"\"=\"\">Messier<\/span>, Network Forensics, S. 166 ff. und 212 ff.<\/td><\/tr>\r\n\r\n<tr class=\"footnotes_plugin_reference_row\"> <th scope=\"row\" class=\"footnote_plugin_index_combi pointer\"  onclick=\"footnote_moveToAnchor_1440_1('footnote_plugin_tooltip_1440_1_8');\"><a id=\"footnote_plugin_reference_1440_1_8\" class=\"footnote_backlink\"><span class=\"footnote_index_arrow\">&#8593;<\/span>8<\/a><\/th> <td class=\"footnote_plugin_text\"><span class=\"autor-continuous-text\">Messier<\/span>, Network Forensics, S. 216.<\/td><\/tr>\r\n\r\n<tr class=\"footnotes_plugin_reference_row\"> <th scope=\"row\" class=\"footnote_plugin_index_combi pointer\"  onclick=\"footnote_moveToAnchor_1440_1('footnote_plugin_tooltip_1440_1_9');\"><a id=\"footnote_plugin_reference_1440_1_9\" class=\"footnote_backlink\"><span class=\"footnote_index_arrow\">&#8593;<\/span>9<\/a><\/th> <td class=\"footnote_plugin_text\">Angelehnt an <span class=\"autor-continuous-text\">Geschonneck<\/span>, S. 153 f.<\/td><\/tr>\r\n\r\n<tr class=\"footnotes_plugin_reference_row\"> <th scope=\"row\" class=\"footnote_plugin_index_combi pointer\"  onclick=\"footnote_moveToAnchor_1440_1('footnote_plugin_tooltip_1440_1_10');\"><a id=\"footnote_plugin_reference_1440_1_10\" class=\"footnote_backlink\"><span class=\"footnote_index_arrow\">&#8593;<\/span>10<\/a><\/th> <td class=\"footnote_plugin_text\"><span class=\"\"autor-continuous-text\"\">BSI<\/span>, Leitfaden IT-Forensik, S. 203; <span class=\"\"autor-continuous-text\"\">Mohan\/Anderson\/Collie\/Del Vel\/McKemmish<\/span>, S. 84 f.<\/td><\/tr>\r\n\r\n <\/tbody> <\/table> <\/div><\/div><script type=\"text\/javascript\"> function footnote_expand_reference_container_1440_1() { jQuery('#footnote_references_container_1440_1').show(); jQuery('#footnote_reference_container_collapse_button_1440_1').text('\u2212'); } function footnote_collapse_reference_container_1440_1() { jQuery('#footnote_references_container_1440_1').hide(); jQuery('#footnote_reference_container_collapse_button_1440_1').text('+'); } function footnote_expand_collapse_reference_container_1440_1() { if (jQuery('#footnote_references_container_1440_1').is(':hidden')) { footnote_expand_reference_container_1440_1(); } else { footnote_collapse_reference_container_1440_1(); } } function footnote_moveToReference_1440_1(p_str_TargetID) { footnote_expand_reference_container_1440_1(); var l_obj_Target = jQuery('#' + p_str_TargetID); if (l_obj_Target.length) { jQuery( 'html, body' ).delay( 0 ); jQuery('html, body').animate({ scrollTop: l_obj_Target.offset().top - window.innerHeight * 0.2 }, 380); } } function footnote_moveToAnchor_1440_1(p_str_TargetID) { footnote_expand_reference_container_1440_1(); var l_obj_Target = jQuery('#' + p_str_TargetID); if (l_obj_Target.length) { jQuery( 'html, body' ).delay( 0 ); jQuery('html, body').animate({ scrollTop: l_obj_Target.offset().top - window.innerHeight * 0.2 }, 380); } }<\/script><\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t<div class=\"elementor-column elementor-col-50 elementor-top-column elementor-element elementor-element-a7d720d\" data-id=\"a7d720d\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap\">\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Log Files Definition und Begriff Logdateien sind fortlaufende Protokolle von Ereignissen. Die Ereignisse werden mit unterschiedlicher Detailtiefe dokumentiert. H\u00e4ufig referenzieren Log Files auf Prozesse, die das Ereignis ausgel\u00f6st oder selbst in die Protokolldatei geschrieben haben. Ebenso wird regelm\u00e4ssig ein Zeitstempel hinzugef\u00fcgt. Dieser Zeitstempel basiert h\u00e4ufig auf der sog. &#8220;Unix epoch&#8221;, wobei es sich um die [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":1000,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":[],"yoast_head":"<title>Log Files - forensics.cyber-kill-chain.ch<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/log-files\/\" \/>\n<meta property=\"og:locale\" content=\"de_DE\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Log Files - forensics.cyber-kill-chain.ch\" \/>\n<meta property=\"og:description\" content=\"Log Files Definition und Begriff Logdateien sind fortlaufende Protokolle von Ereignissen. Die Ereignisse werden mit unterschiedlicher Detailtiefe dokumentiert. H\u00e4ufig referenzieren Log Files auf Prozesse, die das Ereignis ausgel\u00f6st oder selbst in die Protokolldatei geschrieben haben. Ebenso wird regelm\u00e4ssig ein Zeitstempel hinzugef\u00fcgt. Dieser Zeitstempel basiert h\u00e4ufig auf der sog. &#8220;Unix epoch&#8221;, wobei es sich um die [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/log-files\/\" \/>\n<meta property=\"og:site_name\" content=\"forensics.cyber-kill-chain.ch\" \/>\n<meta property=\"article:modified_time\" content=\"2022-01-28T15:49:39+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"5 Minuten\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebSite\",\"@id\":\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/#website\",\"url\":\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/\",\"name\":\"forensics.cyber-kill-chain.ch\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"de-CH\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/log-files\/#webpage\",\"url\":\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/log-files\/\",\"name\":\"Log Files - forensics.cyber-kill-chain.ch\",\"isPartOf\":{\"@id\":\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/#website\"},\"datePublished\":\"2021-09-17T18:28:30+00:00\",\"dateModified\":\"2022-01-28T15:49:39+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/log-files\/#breadcrumb\"},\"inLanguage\":\"de-CH\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/log-files\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/log-files\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cyber Kill Chain Forensics | LAYER 8\",\"item\":\"https:\/\/forensics.cyber-kill-chain.ch\/bin\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Log Files\"}]}]}<\/script>","yoast_head_json":{"title":"Log Files - forensics.cyber-kill-chain.ch","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/log-files\/","og_locale":"de_DE","og_type":"article","og_title":"Log Files - forensics.cyber-kill-chain.ch","og_description":"Log Files Definition und Begriff Logdateien sind fortlaufende Protokolle von Ereignissen. Die Ereignisse werden mit unterschiedlicher Detailtiefe dokumentiert. H\u00e4ufig referenzieren Log Files auf Prozesse, die das Ereignis ausgel\u00f6st oder selbst in die Protokolldatei geschrieben haben. Ebenso wird regelm\u00e4ssig ein Zeitstempel hinzugef\u00fcgt. Dieser Zeitstempel basiert h\u00e4ufig auf der sog. &#8220;Unix epoch&#8221;, wobei es sich um die [&hellip;]","og_url":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/log-files\/","og_site_name":"forensics.cyber-kill-chain.ch","article_modified_time":"2022-01-28T15:49:39+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"5 Minuten"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebSite","@id":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/#website","url":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/","name":"forensics.cyber-kill-chain.ch","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"de-CH"},{"@type":"WebPage","@id":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/log-files\/#webpage","url":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/log-files\/","name":"Log Files - forensics.cyber-kill-chain.ch","isPartOf":{"@id":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/#website"},"datePublished":"2021-09-17T18:28:30+00:00","dateModified":"2022-01-28T15:49:39+00:00","breadcrumb":{"@id":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/log-files\/#breadcrumb"},"inLanguage":"de-CH","potentialAction":[{"@type":"ReadAction","target":["https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/log-files\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/forensic-domains\/log-files\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/"},{"@type":"ListItem","position":2,"name":"Cyber Kill Chain Forensics | LAYER 8","item":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/"},{"@type":"ListItem","position":3,"name":"Log Files"}]}]}},"_links":{"self":[{"href":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/wp-json\/wp\/v2\/pages\/57"}],"collection":[{"href":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/wp-json\/wp\/v2\/comments?post=57"}],"version-history":[{"count":350,"href":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/wp-json\/wp\/v2\/pages\/57\/revisions"}],"predecessor-version":[{"id":2751,"href":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/wp-json\/wp\/v2\/pages\/57\/revisions\/2751"}],"up":[{"embeddable":true,"href":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/wp-json\/wp\/v2\/pages\/1000"}],"wp:attachment":[{"href":"https:\/\/forensics.cyber-kill-chain.ch\/bin\/wp-json\/wp\/v2\/media?parent=57"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}