Tamper-evident is not immutable

Immutable suggests that a record cannot change. Most digital evidence systems make a narrower promise: if protected structure is modified, a verifier can detect the inconsistency. That is tamper evidence. It is valuable precisely because storage can fail, administrators can err and attackers may gain write access.

Tamper-resistant describes another property: the system makes alteration harder through access control, protected hardware, write-once media or operational separation. Resistance and evidence can reinforce one another, but neither word should silently stand in for the other.

A valid signature can authenticate one record while saying nothing about a missing record before it. Sequence numbers, linked hashes, checkpoint ranges and replay state answer different questions: what came before, whether something disappeared, whether an old valid message returned and which set a checkpoint actually covered.

RFC 5848 illustrates this distinction for signed syslog. It addresses origin authentication and integrity while also considering ordering, replay and missing-message detection. The broader lesson is that evidence quality comes from the whole verification contract, not from the presence of a signature field.

A hash chain stored beside the records can reveal an in-place edit, yet a sufficiently privileged actor may rebuild both records and hashes. A checkpoint, published root or witness outside the same administrative failure domain can make that rewrite visible. If the anchor can be replaced by the same actor, the assurance boundary has not moved.

This does not require fashionable distributed-ledger imagery. It requires a clear answer to where the reference lives, who can alter it, how keys rotate, how old checkpoints remain verifiable and how a missing or unreachable witness is reported.

Systems often optimise for a final green verdict and treat missing telemetry as an inconvenience. In an evidence system, a gap, reset, unsigned interval or unavailable verifier is part of the result. Concealing it converts uncertainty into an unsupported assurance claim.

NIST IR 8202 distinguishes properties associated with tamper evidence and tamper resistance from absolute immutability. The practical consequence is modest language: state what the mechanism can reveal, under which verification conditions, and what remains outside the record.

A reviewer should see an edited record, a removed record, a truncated tail, an invalid signature and a missing anchor produce distinguishable outcomes. The exercise should use a dated release and the same verifier relied upon in operation. A diagram that ends in a checkmark is not evidence that these failure states exist.

The response path matters as much as detection. Who is notified, which decisions stop, how evidence is preserved and how a new trusted baseline is established should be defined before the verifier raises an alarm.