What is a raw log?¶

A raw log is the record as created by the original system before it has been reformatted, normalised, enriched or summarised by another tool.

For an investigator, raw does not mean simple. It means closest to the source.

Avoid this assumption: That a raw log is automatically complete, untouched and easy to interpret. It may be none of those things.

A raw log may be a text file, database record, event stream, binary file or provider-held record. It may contain timestamps, event codes, account identifiers, device details, status values and other fields exactly as the source system wrote them.

That can make raw logs valuable because they preserve original field names, ordering, formatting and technical detail that may disappear later. They may also retain identifiers needed to link one event to another.

But raw logs still depend on system configuration. Logging may have been limited, disabled or filtered. Records may have rolled over, been overwritten or never written. A raw export can also be incomplete if only part of the source was selected.

Raw does not mean self-explanatory. Vendor-specific codes, undocumented fields and machine-readable formats may require specialist interpretation. The same field name may mean different things in different products.

Investigators should establish the exact source, system version, collection method and time period. Preserve the original file or provider export without editing it. Record who supplied it, when it was obtained and whether filters were applied.

Work from copies rather than altering the original material. Obtain field definitions, event-code guidance and relevant configuration. Where a dashboard or report exists, compare it with the raw source rather than assuming they are identical.

Operational takeaway¶

A raw log is the closest available record to the source system, but completeness, integrity, configuration and meaning still need to be established.