Stop Manually Modifying Audit Trails

When submission of evidence is required, minimize manual operations as much as possible.
Consider the following options.

1. Submit the file downloaded from the system as is.
2. If that's not possible, use something modified by a program.
3. Use manual editing as a last resort.

Why?

The file editor becomes your name

• It erases the alibi that you didn't edit it yourself. If misconduct is suspected, you would become the primary suspect.
• Changing the last modified date reduces investigative capabilities. This may prolong the time to resolve issues or lead to incorrect root cause analysis.

Regarding the file modification history, it is preferable for the creation date and modification date to match, as shown below.

Humans are not infallible

• Manual processes carry the risk of omissions and oversights.
• Reproducibility of evidence decreases (the certainty that the same output is obtained for the same input decreases).
• Integrity of evidence decreases (the certainty that all data has been processed decreases).

However

• This approach lacks flexibility. You will have to weigh the development man-hours of the program against the reliability of the evidence.