What evidence may indicate log deletion?¶

Evidence of log deletion may appear in the logs themselves, in surrounding system records or in differences between independent copies.

The key is to identify indicators rather than assume deletion from absence alone.

Avoid the dangerous assumption¶

The dangerous assumption is that a missing period proves someone deleted the records.

Several ordinary processes can create the same appearance.

Possible indicators include an explicit log-clear event, administrative command, deletion record, sudden break in sequence numbers, missing rotated files, changed file metadata or a gap beginning immediately after privileged access.

A local log may be missing while the same events remain in a SIEM or remote collector. That difference can support the proposition that the local copy was removed or altered after forwarding.

Conversely, a central gap with complete local records may indicate collector or ingestion failure rather than deletion.

Investigators should establish how the system normally rotates, archives and numbers records. Ask whether clearing a log creates a separate event and where that event would be stored.

Preserve current files, directory listings, file-system metadata, audit-policy changes, service events and administrator activity. Obtain remote, backup or provider-held copies where available.

Look for operational explanations such as maintenance, storage limits, migration, restoration or corrupted files. A recorded support ticket or scheduled change may account for the gap.

Where deletion is suspected, distinguish between deletion of the source log, deletion of an export and expiry under routine retention. Those are different events with different evidential meaning.

Operational takeaway¶

Log deletion may be indicated by clear events, file changes, broken sequences or disagreement between independent copies, but the conclusion must be tested against rotation, retention, maintenance and collection explanations.