> In dealings I have had with the Australian federal police, > the 'authorities' > only wanted me to provide physical copies of logfiles that > they could then > use to corroberate their other evidence from phone records etc. > In Denmark the special department that handles IT-related crimes only need excerpts from the logfiles to build the case, but when presented to the courts they need a copy of the original, correctly-timestamped logfiles in their intirety, even if this exceeds several GBytes of data. But only ISPs are required to log the events of their users. Commercial businesses can do what they please and aren't required to deliver logfiles, but every IT-security department that wants to have good connections to the special IT department, do whatever they can to help. Matias --------------------------------------------------------------------- To unsubscribe, e-mail: loganalysis-unsubscribeat_private For additional commands, e-mail: loganalysis-helpat_private
This archive was generated by hypermail 2b30 : Fri Aug 10 2001 - 11:17:24 PDT