Missing primary access logs need not sink an evidence pack: FRCP 37(e) asks for reasonable steps, not perfection. A defensible pack rebuilds custody from alternate sources such as backups, server logs, file metadata, centralised log copies and native platform exports. It gives due consideration to every plausible explanation where information is incomplete, and it carries sign-off from a reviewer documented as separate from the record owner. Without a separation-of-duties control in the original system, its records cannot prove separation. The credibility has to be created afterwards, through independent leadership, a documented method and attested separation between the people who compiled the record and the person who reviewed it.

Documenting incomplete logs while still showing a good-faith reconstruction

The defensible way to document incomplete access logs is to make the gaps part of the evidence. That means a written method naming which primary records are missing, which secondary sources stand in for them, and what each substitute can and cannot prove. NIST SP 800-86 says that when analysts cannot collect from a primary data source, they should use alternate sources that might hold some or all of the same data.

TechnoLynx can do the engineering side of this reconstruction. Our AI engineering for legal teams page describes how we support counsel with evidence reconstruction and custody documentation. That means listing the secondary sources that survive, mapping where the primary trail breaks, rebuilding lineage with each gap flagged and a confidence level attached, and assembling the result into a structured evidence pack that outside counsel or a forensic specialist can review and attest. The first step is that inventory of surviving sources for the period in question. That pack is not legal advice, not certification and not a promise that the review will pass.

Good faith is a realistic bar, not a perfect one. The 2015 amendment to FRCP Rule 37(e) set a “reasonable steps” standard rather than a perfection standard. Its advisory committee notes accept that perfect preservation of electronically stored information is often impossible. A spoliation claim weakens considerably when the information can be obtained from a backup, a third party or another format. Metadata, server logs, backup records and IT audit trails often document what existed and when it was removed.

Being honest about the gaps is what turns a partial record into a credible one. The NHI Mgmt Group (2026) explains that incomplete logs break non-repudiation: an action may still have happened, but the organisation can no longer reliably prove who did it, under what policy and from which context. A useful gap entry says which of those three questions the surviving evidence answers and which it leaves open. When information about an event is incomplete, NIST SP 800-86 asks analysts to give due weight to every plausible explanation and to say plainly when no conclusion can yet be drawn. Selective disclosure, flagging only the gaps that hurt less and quietly smoothing over the rest, destroys the credibility the reconstruction exists to create.

Fields each reconstructed custody entry should still carry

A reconstruction cannot supply what the original system never recorded. Every entry it does make, though, can meet the standard of a log written at the time. A 2026 TrueScreen guide to US practice says a defensible custody log records, for every transfer: the date and time, who handled it, the action, the cryptographic hash before and after, the storage location and the operator’s signature.

Field	What it records	Why it matters in a reconstruction
Date and time, with UTC or local stated	When the event or acquisition happened	RFC 3227 asks that each timestamp say whether it is UTC or local time, and that the difference between the system clock and UTC be noted
Handler identity	Who held or acted on the record	Ties each entry to a named person
Action taken	Collected, copied, examined or transferred	Lets another analyst repeat the step later
Source hash and verification hash	Digest at acquisition and at each later transfer or analysis	A match shows the copy is identical bit for bit; a mismatch is a custody event that must be documented and explained
Storage location	Where the evidence sat between handlings	Chain of custody requires storing evidence in a secure location when not in use
Operator signature	Who attests the entry	Turns a note into a record someone is accountable for
Source type	Primary record or secondary substitute, and which kind	Tells a reviewer how much weight the entry can bear
Gap flag and confidence	What the entry cannot show, and how sure the reconstruction is	Keeps limitations visible instead of implied

Some secondary sources, such as plain screenshots, carry no hash of their source. For those, the copy is hashed at acquisition and every transfer is logged from then on.

Handling a compliance review once the primary audit trail no longer exists

Auditing handles missing or unconfirmed evidence through alternative procedures. A worked audit-confirmation example shows this. Timing differences and unreturned confirmations are resolved through alternative procedures such as inspecting later cash receipts, shipping documents and sales contracts, and the one exception left is evaluated explicitly. PCAOB AS 1215 makes a related demand of documentation. If an auditor later becomes aware that procedures may not have been performed, the auditor must determine whether sufficient procedures were performed and, if so, demonstrate it.

Should outside counsel or a forensic specialist lead the reconstruction?

Usually counsel should own the structure while a forensic or e-discovery specialist does the technical work. Privilege depends on how the engagement is set up and run, not on whose name is on the contract. A practitioner guide to Kovel-structured engagements explains the limit. The Kovel doctrine extends attorney-client privilege to a specialist who makes the client’s information understandable to counsel, but not to a specialist whose own advice is what the client wants. The same guide stresses that no engagement structure guarantees privilege. Privilege is a question of fact decided on the record, and the stated purpose of a retention is tested against what the specialist actually did.

Work-product protection under FRCP 26(b)(3)(A) can cover a forensic examiner’s work prepared in anticipation of litigation. What matters is that anticipation, not whom the examiner reports to. Privilege does not protect facts. Under Upjohn, dates, accounts and actions can be discovered. Forensic images, log exports and collected artefacts are evidence with preservation duties attached, not work product. An unplanned disclosure to a regulator is the most common route to an argument that privilege was waived. For that reason, the guide recommends deciding in advance who chooses what is disclosed.

Independence is the second reason to bring in an outside party. NIST SP 800-86 notes that if an incident may involve a member of the incident handling team, it is preferable to have an independent third party perform the forensic work. Reconstructing access history for a group whose own access is in question is exactly that situation. Whoever does the technical work should meet testifying standards from the start: documented acquisition and verification, an analysis record someone else could reproduce, and observation kept separate from inference. Work built that way survives if the examiner is later designated as an expert witness. The guide also recommends that where two investigation tracks run side by side, they use different staff where feasible, separate evidence stores, separate reporting and separate billing. How the engagement is structured is counsel’s decision. A technical contributor’s job is to know which track their work belongs to and keep the record consistent with it.

What breaks the chain of custody in a reconstructed record

A chain of custody breaks wherever someone cannot account for who held the evidence, what was done to it, or whether it is still the same data. The TrueScreen guide lists patterns that have led US federal courts to exclude or limit forensic testimony:

• an examiner who could not say who held a device between seizure and acquisition
• an acquisition hash that was never recorded
• working copies made from a master copy that was never logged
• deleted files recovered from a device that was booted live without a write-blocker

None of these needs deliberate misconduct.

A break is not automatically fatal. Under Federal Rule of Evidence 901, the chain of custody is a measure of how strong the proof is, not a separate rule. A broken chain shifts the burden of persuasion and opens an argument under FRE 403 that the evidence’s value is outweighed by the risk of confusion or unfair prejudice. Courts respond in stages:

• A minor logging gap that does not affect integrity rarely leads to exclusion, and the jury decides how much weight to give it.
• Where ESI that should have been preserved was lost, a gap that affects integrity may lead to curative measures under FRCP 37(e)(1), such as extra foundation testimony or redoing the collection.
• A finding of intent to deprive in that same loss opens the most severe sanctions, under FRCP 37(e)(2).

That gap between weight and admissibility is the ground a reconstruction is fighting on. FRE 902(13) and 902(14) were added in December 2017. Under 902(14), a copy can be authenticated by written certification from a qualified person when its hash matches the source. A defensible certification states the signer’s qualifications, the source system, the acquisition method with tool and version, the date and time, and the hash algorithm and value. Plain screenshots carry no hash of the source rendering. For those, the party offering the evidence has to assemble distinctive characteristics from outside the file under FRE 901(b)(4), such as metadata, witness testimony and corroborating posts. A native platform export carries better provenance than a screenshot because it is a structured archive with metadata.

When reconstructed audit evidence is sufficient and reliable enough to defend

Reconstructed audit evidence can be defended when sources independent of the people being evidenced back up its weakest parts, and when the amount of corroboration grows with how weak those parts are.

• Evidence from a knowledgeable source independent of the company is more reliable than evidence from internal sources alone.
• Information the company generates internally is more reliable when the company’s controls over it are effective.
• Evidence the auditor obtains directly beats evidence obtained indirectly.
• Original documents beat copies.

AS 1105 also links quantity to quality: higher-quality evidence needs less corroboration, and higher risk needs more evidence.

A system with no separation-of-duties control lacks exactly that effective control. Its internal records therefore rank lower and need more corroboration than they would in a well-controlled environment. Varsity Tutors’ auditing material states the same inverse relationship: when controls are weak and documents are generated internally, more procedures must be performed. The best external anchors to look for are records held outside the evidenced group’s control, such as provider-held cloud audit logs, identity-provider records and third-party platform exports.

RFC 3227 adds the test for evidence itself. Computer evidence must be admissible, authentic, complete, reliable and believable, and collection methods should be clear and repeatable enough for independent experts to test them. Completeness is where any reconstruction is weakest. A rebuilt chain is weaker evidence than an intact primary trail and may be challenged on that ground. The pack should show that challenge was anticipated, not deny it.

Who should sign off on the reconstructed evidence pack?

Sign-off should come from a reviewer independent of the group whose access the pack evidences. That reviewer should have had no access to the evidenced systems during the period in question, not merely no access today. Practitioner guidance on audit trail review, drawing on ISO 19011 and PIC/S PI 041-1, says reviewers cannot review their own work or their direct reports’ work. Independence means documented separation from the record owner, not “someone else from QA” who reports to that owner. The GAO’s Government Auditing Standards set out two tests. Independence of mind means judgement that outside influences have not compromised. Independence in appearance means no circumstances that would lead a reasonable, informed third party to conclude objectivity was compromised. The same standards name a self-review threat: the risk that an auditor will not properly evaluate judgements from their own earlier services. An administrator of the evidenced systems signing the pack is that threat in its plainest form.

If the original system did record separate identities for the people who compiled records and the people who reviewed them, the attestation should use those identities directly. Guidance on testing separation of duties from the NHI Mgmt Group (2026) adds a warning. If approvals are stored outside the identity platform, or a transaction cannot be linked to the user who carried it out, the test cannot prove separation.

How to attest role separation retroactively when the original system had none

A retroactive attestation works as a compensating control: an independent review step, added now and documented, that stands in for the separation the system never enforced. Published segregation-of-duties guidance describes adding compensating controls after risk analysis where segregation of duties is imperfect. For example, when duties are combined, independent authorisation and verification, including independent audits, can detect and correct discrepancies. NIST SP 800-53 control AC-5, in its OT discussion, gives increased personnel security and auditing as example compensating controls. Control CA-2(1) adds that when assessors sit in the system owner’s development, operational or management chain, independence can be achieved by having independent teams of experts carefully review the results.

Compensating controls such as independent review reduce risk but are not equivalent to true separation. When a duty cannot be separated, the compensating control must be independent, timely and evidenced. A retroactive attestation is therefore not equivalent to separation enforced at the time. Its credibility comes from how open and consistent the compensating process is, not from the original system design.

Building the attestation chain, in order

1. Map current people and roles against the historical access records for the period. Trace who approved and who carried out each sensitive step, and compare that with their actual permissions.
2. Rule out anyone who could reach the evidenced systems during that period, including through inherited permissions, privileged group membership or emergency break-glass access.
3. Write down the reasoning for the compensating control: why native separation was absent, what independent review replaces it, and which independence test was applied.
4. Record compilers in the pack as compilers, so nobody’s role is ambiguous.
5. The reviewer signs a record naming the period reviewed, the scope, the findings, the follow-up and an explicit statement that the review was completed.
6. Sign the pack, with attestations showing who created and who reviewed each part and a digest showing nothing changed in transit. The Evidence Pack format, for instance, records signer identities alongside a manifest digest.

If the same exception keeps coming back, it is a design problem rather than a temporary waiver. The lasting fix is to build role-separated approval gates and audit workflows into the system, so the next evidence pack is collected as things happen instead of reconstructed afterwards.

How far a reconstruction can honestly reach

A documented method, open gap-flagging and an independent signature make a partial record defensible. They do not decide how much that partial record can support. Someone still has to decide whether the surviving evidence answers the question the insurer, bar reviewer or auditor is actually asking. That decision belongs to counsel and the independent reviewer, working from the gap register. Sometimes the honest finding is the one NIST SP 800-86 allows for: no conclusion can yet be drawn.

FAQ

What is the chain of custody?

For digital evidence, the chain of custody is the documented, chronological trail showing that an electronic file is the same one collected at the source, in the same condition, handled only by identified people through documented steps.

What is the definition of audit evidence?

Audit evidence is all the information an auditor uses to reach the conclusions the audit opinion rests on. That includes the accounting records and other information gathered during the engagement.

What is the purpose of attestation in an audit evidence pack?

An attestation records who created or reviewed the evidence. Tools sign automatically, and auditors sign after their review, so whoever relies on the pack can decide which signers to trust.