Honeypot trace forensics: The observation viewpoint matters