Evidencestore is a new open-source tool designed to serve as a tamper-evident witness for system logs on remote machines. It ensures that investigators can prove specific log entries existed at a precise time, even after an attacker with root access deletes or modifies them on the source server.
The demonstration scenario involves four critical lines in /var/log/auth.log that recorded a failed root login attempt from IP address 203.0.113.7, followed by a successful login and the download of a suspicious file to /tmp/.x. An attacker erased these lines using sed -i, leaving only unrelated deployment entries. Because the remote store had already received the lines, the evidence remained intact.
The architecture separates concerns across three components. The escollect collector runs near the log source, assigns sequential numbers, buffers entries on disk, and transmits them over TLS 1.3 using client certificates. The central evidencestore service builds a hash chain with Merkle trees every second and periodically obtains RFC 3161 timestamps from external authorities. The esverify utility allows any party to validate individual records offline using only public keys and the provided proof package.
Key protections include monotonic clocks to bound time drift, automatic detection of missing sequence numbers, conflict detection when a collector restarts from an old snapshot, and fsync guarantees before acknowledging writes. Records are encrypted with AES-GCM, and each entry includes a commitment that prevents the storage operator from presenting different plaintexts under the same commitment to different verifiers.
The project explicitly addresses common weaknesses in existing approaches such as journald Forward Secure Sealing, immudb, and simple hash chains. It supports deletion of old records by age without breaking proofs for remaining entries and makes gaps in the log sequence visible. The code is written in Go, released under the Apache 2.0 license, and developed with assistance from Claude Code.
