Log Analysis

[Forensik]

Hi there,

i have imaged a linux root-partition containing log files fe kern.log and syslog. Now i´d like to analyze the logfiles. Any suggestion which log file analyzer to use (Within osforensics) to build timelines and analyze specific events?

Best regards

[David (PassMark)]

Opening the Linux disk image in OSF should be no problem.

There is no special function in OSF for parsing the Linux kern.log and syslog files however. But the entries in these files should already be in chronological order.

Of course you could view the file in the internal text viewer. But equally you might be better off exporting the files from the disk image (from within OSF) then manipulate the file in Excel.