If an attacker modifies log entries to mislead investigators, this is known as what?

If an attacker modifies log entries to mislead investigators, this is known as what?

• A. Deleting Files
• B. Manipulating Logs
• C. Clearing Logs
• D. Covering Tracks on the OS

Answer: (B)

Altering the records in system logs to mislead investigators is known as manipulating logs. Logs capture what happened on a system—logins, file access, commands run, and other events with timestamps. When an attacker edits or fabricates those entries, they’re directly tampering with the evidence trail, trying to hide actions or make them look benign. That precise activity is what “manipulating logs” describes. This is more specific than removing or clearing logs. Deleting files or clearing logs would remove evidence or wipe traces, but they don’t inherently imply changing what’s already recorded. Covering tracks on the OS is a broader idea that includes various techniques to evade detection; manipulating logs is one targeted method within that broader goal. Understanding that distinction helps in recognizing anti-forensic techniques and building defenses like tamper-evident logging, centralized and write-once logs, and integrity checks.

Altering the records in system logs to mislead investigators is known as manipulating logs. Logs capture what happened on a system—logins, file access, commands run, and other events with timestamps. When an attacker edits or fabricates those entries, they’re directly tampering with the evidence trail, trying to hide actions or make them look benign. That precise activity is what “manipulating logs” describes.

This is more specific than removing or clearing logs. Deleting files or clearing logs would remove evidence or wipe traces, but they don’t inherently imply changing what’s already recorded. Covering tracks on the OS is a broader idea that includes various techniques to evade detection; manipulating logs is one targeted method within that broader goal. Understanding that distinction helps in recognizing anti-forensic techniques and building defenses like tamper-evident logging, centralized and write-once logs, and integrity checks.