Log forensics in Cybersecurity - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Log Integrity

Why is ensuring the integrity of log files critical in log forensics?

A Because altered logs can mislead investigators and hide malicious activity

B Because logs need to be deleted after investigation to protect privacy

C Because logs are only useful if they are stored in plain text format

D Because logs must be encrypted to prevent unauthorized reading

💡 Hint

Think about what happens if someone changes the logs before analysis.

Integrity means logs have not been changed. If logs are altered, investigators may miss or misunderstand attacks.

📋 Factual

intermediate

Common Log Sources in Forensics

Which of the following is NOT typically considered a primary source of logs for forensic analysis?

A Web server access logs

B User's personal diary

C Operating system event logs

D Firewall logs

💡 Hint

Consider what types of logs record system or network activity.

Firewall, web server, and OS logs record technical events useful for forensics. A personal diary is unrelated.

🚀 Application

advanced

Analyzing Timestamp Discrepancies

You find two log entries from different systems that should record the same event, but their timestamps differ by several hours. What is the most likely cause?

A The logs are corrupted and cannot be trusted

B The event happened twice at different times

C The event was fabricated by an attacker

D One system's clock is set to a different time zone or is unsynchronized

💡 Hint

Think about how system clocks and time zones affect timestamps.

Different systems may have clocks set to different time zones or may not be synchronized, causing timestamp differences.

🔍 Analysis

advanced

Identifying Log Tampering

Which of the following signs in a log file most strongly suggests tampering?

A Missing log entries for a critical time period

B Consistent formatting and sequential timestamps

C Presence of error messages related to system failures

D Logs stored in a compressed archive

💡 Hint

Consider what unusual gaps or missing data might indicate.

Missing entries during important times can indicate someone deleted or altered logs to hide activity.

❓ Reasoning

expert

Chain of Custody in Log Forensics

Why is maintaining a strict chain of custody for log files essential during a forensic investigation?

A To ensure logs are deleted immediately after analysis to protect privacy

B To allow anyone to edit the logs freely during the investigation

C To prove that the logs have been handled securely and remain admissible as evidence in court

D To make logs publicly available for transparency

💡 Hint

Think about legal requirements for evidence handling.

The chain of custody documents who handled the logs and when, ensuring evidence is trustworthy and legally valid.