Does a missing log prove evidence was deleted?¶
The practical answer¶
No. A missing log does not by itself prove deliberate deletion.
The key evidential caution¶
The dangerous assumption is that absence of evidence is evidence of anti-forensics.
Logs may be missing because:
Key points¶
- logging was never enabled
- the source did not record that event
- retention expired
- collection failed
- the system was offline
- storage was full
- the device was rebuilt
- the provider did not retain the data
- time or query filters were wrong
What investigators should establish¶
Investigators should establish:
Key points¶
- whether the log source existed
- what it normally recorded
- whether collection was healthy
- what retention applied
- whether adjacent records survive
- whether a clear, delete or service-stop event exists
- whether copies remain elsewhere
A gap may still be important.
It may limit the strength of conclusions and require alternative evidence.
But it should not be converted into proof of deliberate removal without supporting records.
Where a log-clear event, deletion command or configuration change exists, preserve it and link it to the relevant account, process and timeline.
Evidential limits¶
Do not assume that one missing source means the event did not occur.
Other systems, providers or endpoints may record the same action.
The expected record should be tested against the product version, configuration and event type. Investigators sometimes search for a log that the system was never capable of producing. Confirm the logging design before treating absence as suspicious or exculpatory.
Also compare the missing period with system uptime, service restarts, storage warnings and collection-agent health. A precise gap beginning and ending with suspicious activity may support concern, but the pattern still requires explanation from the underlying system records.
Operational takeaway¶
Treat missing logs as an evidential limitation unless there is separate evidence showing deliberate deletion, disabling or alteration.