Digital Evidence · Topic 6 of 8
Log Admissibility and Web Server Logs
Learn when logs are admissible as evidence, how to keep them authentic and intact, centralized log management, and how to read IIS and Apache logs.
- 6 min
- Logs must be routine, authentic and unaltered to be admissible.
- Hash logs, forward them to a separate system and keep clocks synchronized.
- Syslog uses port 514, and 6514 over TLS.
What it is
Logs are records that systems write about their own activity. They can show who did what and when, but only if a court accepts them. That requires logs to be created in the normal course of business, kept intact and shown to be authentic.
The exam asks about the legal criteria, the controls that protect log integrity, centralized logging, and how to read IIS and Apache log lines.
How it works
Logs as evidence and legal criteria
Logs written or entered by people are out of court statements and raise hearsay issues. Purely machine generated output is generally not treated as hearsay, but it still has to be authenticated. In the United States the Federal Rules of Evidence handle this in a few main ways.
| Rule | Idea |
|---|---|
| FRE 803(6), business records | Records made at or near the time by someone with knowledge, kept in the course of regular activity, with making the record a regular practice |
| FRE 901 | Evidence must be authenticated: shown to be what it claims to be |
| FRE 902(11), 902(13), 902(14) | Records can be self authenticating with a certification by a qualified person. 902(13) covers records generated by an electronic process. 902(14) covers data copied from a device when authenticated by a hash value. |
| FRE 1001 to 1004 | Best evidence: an accurate printout or copy of electronic data can serve as an original |
Courts look at whether the logging was routine, automatic and consistent, whether it was trustworthy, and whether it was altered. Logs created only after an incident invite challenges.
Guidelines for credibility and usability
- Log consistently, with a documented policy that is followed every day.
- Synchronize clocks with NTP and record in UTC where possible.
- Record who, what, when, where and the outcome.
- Restrict access, and separate log administrators from those being monitored.
- Keep logs for the retention period the law and policy require.
- Document how the logs were collected and who handled them (chain of custody).
Authenticity and integrity
| Control | Purpose |
|---|---|
| Hash of log files (SHA-256) and signed hash lists | Show that content has not changed |
| Write once storage (WORM) | Prevent alteration |
| Forwarding to a separate server in real time | A copy exists even if the host is compromised |
| Encrypted transport such as TLS | Protects logs in transit |
| Strict permissions and audit of access | Prevent and detect tampering |
| Backups | Recovery if logs are lost |
Centralized log management
Centralized logging sends events from many hosts to one place. Syslog uses UDP or TCP port 514, and TCP with TLS on 6514. Windows uses Windows Event Forwarding to a collector. A SIEM or log platform such as Graylog or an Elastic stack indexes the data.
On Linux, rsyslog can forward all messages over TCP with one line in its configuration:
*.* @@loghost.example.com:514A single @ would use UDP. Benefits are tamper resistance, correlation across systems and faster search. Challenges are volume, clock differences between hosts and keeping the central store secure.
IIS architecture and logs
IIS handles requests through the kernel mode driver HTTP.sys, the Windows Process Activation Service (WAS) and the World Wide Web Publishing Service (W3SVC). Requests run in worker processes (w3wp.exe) grouped in application pools. Settings are in applicationHost.config.
Default logs are in %SystemDrive%\inetpub\logs\LogFiles\W3SVC1 (the number follows the site ID). The default W3C format uses UTC time. Request errors from HTTP.sys go to the HTTPERR folder.
Common W3C fields: date, time, s-ip, cs-method, cs-uri-stem, cs-uri-query, s-port, cs-username, c-ip, cs(User-Agent), sc-status, sc-substatus, sc-win32-status, time-taken.
Analyzing IIS logs
Look for these signs: a burst of 404 or 401 responses from one client address, a POST to an unusual file (possible web shell), SQL keywords or encoded characters in cs-uri-query, an unusual user agent, large time-taken values, and 500 errors after crafted requests. Tools include Log Parser Studio, grep or findstr, and SIEM searches.
Apache architecture and logs
Apache HTTP Server uses modules (such as mod_ssl and mod_rewrite) and a process model chosen by the multi processing module (prefork, worker or event). Configuration is in httpd.conf or apache2.conf. Logs use the directives CustomLog and ErrorLog.
Typical locations: /var/log/apache2/ on Debian and Ubuntu, /var/log/httpd/ on Red Hat based systems.
Apache access and error logs
The Combined Log Format has this shape. The example below uses a documentation address.
203.0.113.9 - - [14/Oct/2026:02:10:44 +0000] "GET /index.php?id=1%27 HTTP/1.1" 500 512 "-" "Mozilla/5.0"Fields in order: client address, identity, user, time, request line, status, bytes, referrer and user agent. The Common Log Format is the same without referrer and user agent.
The error log holds the time, module and level, process ID, client address and a message. Use it to see failed requests, script errors and denied access.
A worked example
An IIS log shows hundreds of requests from one address to the same page with quote characters in cs-uri-query, then one POST with status 200 to an unfamiliar .aspx file.
The pattern fits injection probing followed by an upload and use of a web shell. The investigator hashes the log, preserves the file and compares the time with other server logs.
How the exam asks about this
- "Which U.S. rule treats regularly kept records as an exception to hearsay?" → The business records exception, FRE 803(6).
- "What is the default IIS log format?" → W3C.
- "Which Apache directive defines where the access log is written?" → CustomLog.
What to remember for the exam
- Logs must be routine, authentic and unaltered to be admissible.
- Hash logs, forward them to a separate system and keep clocks synchronized.
- Syslog uses port 514, and 6514 over TLS.
- IIS logs sit in inetpub\logs\LogFiles\W3SVC1 and use UTC in W3C format.
- Apache access logs use Common or Combined Log Format.
Logs that were only enabled after the incident, or that were edited, can lose their business record status and be excluded.
Common mistakes
Relying on one copy. A compromised host can alter its own logs. Keep a remote copy.
Ignoring time zones. IIS W3C logs are in UTC while the server clock may show local time.
Reading a 200 status as harmless. A successful response to a malicious request is the worst case.
Check yourself
Which control shows a log file was not changed after collection?
A hash of the file, recorded and ideally signed, compared at later reads.
Where does IIS write its default logs?
In %SystemDrive%\inetpub\logs\LogFiles\W3SVC1, one folder per site ID.
What does the Combined Log Format add to the Common Log Format?
The referrer and the user agent.
Topic 6 of 8 in Digital Evidence
Test yourself on Digital Evidence
The full EC-Council 312-49 question bank has 900 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.