say you had a disk image of a host that only had filesystem logging and you wanted to see events etc that were captured