And how about let's provide the link:
Computer Data and the Federal Rules of Evidence
Short summary: Despite all the technical reasons why logs may be unreliable, the case law indicates that without evidence of tampering, and if logs are used for day-to-day business purposes, they can be admitted into court as if they were expert witness testimony.
Thanks for the name check, Blaise. My favorite place to send people for information about how to make computer data admissable in court is a paper by Orin Kerr, former Dept. of Justice attorney and now a prof at George Washington, specializing in technology issues. He wrote a great summary of >>current>caselawevidencecould have been tampered with.
This of course makes life a lot easier for your sys admin in the trenches, who doesn't have time to set up an encrypted write once file system...
Slashdot Mirror
And how about let's provide the link: Computer Data and the Federal Rules of Evidence Short summary: Despite all the technical reasons why logs may be unreliable, the case law indicates that without evidence of tampering, and if logs are used for day-to-day business purposes, they can be admitted into court as if they were expert witness testimony.
Thanks for the name check, Blaise. My favorite place to send people for information about how to make computer data admissable in court is a paper by Orin Kerr, former Dept. of Justice attorney and now a prof at George Washington, specializing in technology issues. He wrote a great summary of >>current>caselawevidencecould have been tampered with.
This of course makes life a lot easier for your sys admin in the trenches, who doesn't have time to set up an encrypted write once file system...