Skip to content
CIM-222 Cyber Incidents & Offender Methods

Does a missing log prove evidence was deleted?

The practical answer

No. A missing log does not by itself prove deliberate deletion.

The key evidential caution

The dangerous assumption is that absence of evidence is evidence of anti-forensics.

Logs may be missing because:

Key points

  • logging was never enabled
  • the source did not record that event
  • retention expired
  • collection failed
  • the system was offline
  • storage was full
  • the device was rebuilt
  • the provider did not retain the data
  • time or query filters were wrong

What investigators should establish

Investigators should establish:

Key points

  • whether the log source existed
  • what it normally recorded
  • whether collection was healthy
  • what retention applied
  • whether adjacent records survive
  • whether a clear, delete or service-stop event exists
  • whether copies remain elsewhere

A gap may still be important.

It may limit the strength of conclusions and require alternative evidence.

But it should not be converted into proof of deliberate removal without supporting records.

Where a log-clear event, deletion command or configuration change exists, preserve it and link it to the relevant account, process and timeline.

Evidential limits

Do not assume that one missing source means the event did not occur.

Other systems, providers or endpoints may record the same action.

The expected record should be tested against the product version, configuration and event type. Investigators sometimes search for a log that the system was never capable of producing. Confirm the logging design before treating absence as suspicious or exculpatory.

Also compare the missing period with system uptime, service restarts, storage warnings and collection-agent health. A precise gap beginning and ending with suspicious activity may support concern, but the pattern still requires explanation from the underlying system records.

Operational takeaway

Treat missing logs as an evidential limitation unless there is separate evidence showing deliberate deletion, disabling or alteration.

Keep moving

Where this question leads

These links explain why the next page may matter, rather than presenting an undifferentiated list.