Thread by @ErrataRob

FYI: "audit" logs and "forensics" logs are different beasts.

Traditionally, an "audit" is when the auditor is trying to confirm something specific, like whether your numbers add up or you correctly followed procedures.

A "forensics" investigation is open-ended, indeterminate.

https://twitter.com/SwiftOnSecurity/status/1452419588050886659

An audit starts with something is known, such as reporting quarterly results, and seeks to confirm that they are actually true.

A forensics results with an unsolved crime, and hopes to maybe find out what happened, and half the time, comes to no conclusion.

They do overlap. Forensic auditors seek to find money that people try to hide off books or embezzle, for example. Before computer logs, I'm not sure if there was an important distinction.

But with computers, the difference becomes important. Take, for example, the claims that election computers were connected to the Internet (from Maricopa, Arizona and Mesa, Colorado). These claims come not from "audit" logs but "forensics" logs, and that's important.

If an "audit" log, there would be a clear and unambiguous record of everything the computer connected to. Testing whether it was connected to the Internet would be a simple yes/no question an auditor could answer.

But we don't have that. We must instead do a forensics examination of the computer in order to search for clues. And what we find gives us unsatisfactory answers, some anomalies that might be explained by Internet connectivity.

In Dominion's election systems, standard practice eventually wipes the system logs but preserves the election audit trail. Trumpists claim that this means elections cannot be audited. Hence, this distinction becomes important.

Since Trumpists released the disk image of the Mesa (Colorado) system to the Internet, we can see for ourself. I've thoroughly forensicsed (sic) the image and can find no conclusion either way about what they say about Internet connectivity or hacking.

The point is that most of the time, nobody cares about the difference between "audit logs" and "forensics logs" -- until something like this happens and the difference becomes really important.