How to Use Logs for Forensics After a Data Breach