Forum
5

How do I prove a log was not tampered with, months later?

asked by a8hda 22 days ago

Being asked to demonstrate integrity for an incident from last year and I am not sure what a good answer even looks like.

1 answer

Sign in to answer.
gerald (Gerald) 1 point 20 days ago

Chain of custody matters more than cryptography here.

What you want to show is that the log left the originating system immediately, landed somewhere that system had no write access to, only named people could read it, and every access is recorded.

A hash is useful supporting evidence but on its own it proves the file matches a hash you also control. If both live in the same place under the same control it demonstrates less than people think.

Guidelines Newest Search Back to Trunc