\input zb-basic
\input zb-ioport
\iteman{io-port 05706127}
\itemau{Chou, Bin-Hui; Takahashi, Kenichi; Hori, Yoshiaki; Sakurai, Kouichi}
\itemti{Reconsidering data logging in light of digital forensics.}
\itemso{Park, Jong Hyuk (ed.) et al., Advances in information security and its application. Third international conference, ISA 2009, Seoul, Korea, June 25--27, 2009. Proceedings. Berlin: Springer (ISBN 978-3-642-02632-4/pbk; 978-3-642-02633-1/ebook). Communications in Computer and Information Science 36, 111-118 (2009).}
\itemab
Summary: Logs record the events that have happened within in a system so they are considered the history of system activities. They are one of the objects that digital forensic investigators would like to examine when a security incident happens. However, logs were initially created for trouble shooting, and are not purposefully designed for digital forensics. Thus, enormous and redundant log data make analysis tasks complicated and time-consuming to find valuable information, and make logging-related techniques difficult utilized in some systems such as embedded systems. In this paper, we reconsider a data logging mechanism in terms of forensics and consequently, we propose purpose-based forensic logging. In purpose-based forensic logging, we only collect the required logs according to a specific purpose, which could decrease the space that logs occupy and may mitigate the analysis tasks during forensic investigations.
\itemrv{~}
\itemcc{}
\itemut{log; evidence acquisition; purpose-based; digital forensics}
\itemli{doi:10.1007/978-3-642-02633-1\_15}
\end