Using logs for forensics after a data breach

08.11.2010

One way of proving both log integrity as well as log sequence integrity is to store raw logs in flat files that are digitally signed or at least hashed using a strong hashing mechanism.  Pros and cons are as follows.

Store raw logs as is:

* Logs are available in original format for most flexibility in subsequent use.

* Difficult/impossible to guarantee their integrity.

* Storage requirement fits complexity of logs.