What is log tampering?¶

Log tampering is deliberate interference with log creation, content, storage or availability in order to mislead, conceal or obstruct later review.

It can occur before, during or after the relevant activity.

Avoid the dangerous assumption¶

The dangerous assumption is that log tampering means only deleting a file.

It can take several forms.

A person may disable logging, change audit policy, alter timestamps, edit records, delete selected entries, clear an entire log, stop a collector or redirect events to another location. They may also manipulate the system clock or generate misleading entries.

Tampering may involve local administrator access, cloud privileges, application rights or control of the collection pipeline. In some systems, direct editing is difficult, but deletion or suppression may still be possible.

Investigators should identify the exact source, storage method and controls protecting the records. Ask whether logs were append-only, centrally collected, digitally signed, replicated or protected from ordinary administrators.

Evidence of tampering may include administrative change records, unexplained service stoppage, differences between local and remote copies, broken sequence numbers, altered file metadata or gaps beginning immediately after privileged access.

But no single indicator proves tampering. Rotation, migration, maintenance and corruption can produce similar effects.

Preserve the original files, metadata, system configuration, audit records and independent copies. Avoid opening or resaving files in ways that alter them unnecessarily. Seek specialist support where authenticity, file structure or system internals need examination.

Operational takeaway¶

Log tampering is deliberate interference with the creation, content or availability of records, and it should be concluded only where the mechanism, access and supporting indicators are established.