Honeypot trace forensics : The observation viewpoint matters