Of course, logfiles record system activity with relatively low time resolution. The reconstructed behavior would be a little stiff and jerky, like the monster in Frankenstein . Most computer systems do not record sufficient information for Frankenstein-like experiments. Still, computers produce numerous logs in the course of their activities. For example, UNIX systems routinely maintain records of logins and logouts, of commands executed on the system, and of network connections made to the system.
Individual subsystems maintain their own logging.
Mail delivery software, for instance, maintains a record of delivery attempts, and the cron daemon for unattended command execution has its own activity logs. Each individual logfile gives its own limited view of what happened on a system, and that view may be completely wrong when an intruder has had opportunity to tamper with the record. The next couple of paragraphs focus on how multiple sources of information must be correlated before one can make a sensible judgment. The examples are UNIX specific, but that is hardly relevant. Each source of information is shown at a different indentation level.