[semimojo]

Then where is the report on what was discovered by the FBI? There is always paperwork. Why did the FBI need to get copies of the logs if they had imaged drives of the servers?

I don't know if those reports have been released or not - I haven't looked for them.

As to the logs, I don't know that either but it may be a function of the security architecture employed. Perhaps the logs were from dedicated perimeter monitoring devices?

Either way, does the fact that we haven't seen everything mean the FBI is lying when they say they got enough to confirm CrowdStrike's analysis?

[philman_36]

Perhaps the logs were from dedicated perimeter monitoring devices?

Why would the Cyber Crime unit/FBI even need that if they had the images? The logs would be resident on them.
The only logical answer is that CrowdStrike gave them the copies since their forensic analysis is the ONLY stated forensic analysis to have been conducted.

Either way, does the fact that we haven't seen everything mean the FBI is lying when they say they got enough to confirm CrowdStrike's analysis?

That isn't the issue. The issue is the claim that the FBI did a forensic analysis when it can't be shown that they did in fact carry out their own independent forensic analysis.