Analyzing multiple logs for forensic evidence 5