312-49V11 · Question #106
You're a forensic investigator tasked with analyzing a potential security breach on an Internet Information Services (IIS) web server. Your objective is to collect and analyze IIS logs to determine…
The correct answer is C. %SystemDrive%\inetpub\logs\LogFiles. According to the CHFI v11 objectives under Web Application Forensics and Log Analysis, knowing the default storage locations of web server logs is essential for reconstructing web- based attacks. On Windows Server operating systems, Internet Information Services (IIS) stores…
Question
You're a forensic investigator tasked with analyzing a potential security breach on an Internet Information Services (IIS) web server. Your objective is to collect and analyze IIS logs to determine how and from where the attack occurred. Where are IIS log files typically stored by default on Windows Server operating systems?
Options
- A%AppData%\Microsoft\IIS\Logs
- B%ProgramFiles%\IIS\Logs
- C%SystemDrive%\inetpub\logs\LogFiles
- D%SystemRoot%\Logs\IIS
How the community answered
(22 responses)- A5% (1)
- B14% (3)
- C77% (17)
- D5% (1)
Explanation
According to the CHFI v11 objectives under Web Application Forensics and Log Analysis, knowing the default storage locations of web server logs is essential for reconstructing web- based attacks. On Windows Server operating systems, Internet Information Services (IIS) stores its HTTP and HTTPS request logs by default in the directory: %SystemDrive%\inetpub\logs\LogFiles This directory contains subfolders such as W3SVC1, W3SVC2, etc., where each folder corresponds to a specific IIS website instance. The log files stored here record critical forensic details including client IP addresses, timestamps, HTTP methods, requested URLs, status codes, user agents, and referrers. These artifacts allow investigators to identify attack vectors such as SQL injection, command injection, directory traversal, brute-force attempts, and web shell
Topics
Community Discussion
No community discussion yet for this question.