I second this comment. Logs are usually only good if they are captive and only the overseers have access to them, otherwise unless you catch it real-time you generally won't be able to do any meaningful forensics. Well, unless the suspects are just really stupid which is entirely possible