That would depend on the employment contract. Until I had corporate legal amend my contract, anything copyrightable I did, between the moment of signing the contract and resigning my job, would've been the property of the company, if they wanted. With the amendment, only things done on company equipment or company time falls within the scope of being the company's.
I believe you're not ENTIRELY correct there, as there's both an IP address and a specific time tied to a request (or, at least, could be).
Spurious comparisons aren't a help either.
Gamble compared CEOPâ(TM)s work to transport police, who are allowed to travel free on trains. âoeThey wonâ(TM)t have to buy a ticket to get on the train â" and you compare the train system to the online network; they wonâ(TM)t pay or have to cajole or convince the conductor to give them the information about the threatening person whoâ(TM)s in the carriage down the back,â he said.
First off, the marginal cost of having a Transport Police officer on the train is negligible. Second, having someone rummage through logs for specific information is time taken from other tasks and depending on what exactly has been requested may take a good while (up to at least an hour is withing what I'd consider sensible, depending on the log availability and the precision set out in the request).
No amount of careful planning will ever replace dumb luck.