Chain of custody matters more than cryptography here.
What you want to show is that the log left the originating system immediately, landed somewhere that system had no write access to, only named people could read it, and every access is recorded.
A hash is useful supporting evidence but on its own it proves the file matches a hash you also control. If both live in the same place under the same control it demonstrates less than people think.
Chain of custody matters more than cryptography here.
What you want to show is that the log left the originating system immediately, landed somewhere that system had no write access to, only named people could read it, and every access is recorded.
A hash is useful supporting evidence but on its own it proves the file matches a hash you also control. If both live in the same place under the same control it demonstrates less than people think.