Tamper-evident logging means recording security and system events in a way that makes later alteration detectable. The logs may not be impossible to change, but they are designed so that edits, deletions, or reordering leave evidence behind. Common techniques include cryptographic hashes, append-only storage, digital signatures, and off-site or write-once copies.
This matters because logs are often the main proof of what happened during an intrusion or an internal abuse case. If an attacker can erase failed logins, hide privileged actions, or rewrite timestamps, defenders lose visibility and may not be able to trust incident timelines. In practice, tamper-evident logging supports forensics, compliance, and review of sensitive changes such as metadata edits in digital collections. It is strongest when paired with controlled access, version history, and independent monitoring that can compare records across systems.