Honeypot traces forensics : the observation view point matters