&gt; Sending logs off as they&#x27;re written to a centralized logging server or a time-series database would have been useful in this context.<p>Schneier &amp; Kelsey&#x27;s paper <i>Secure Audit Logs to Support Computer Forensics</i>[1] seems relevant here.  At the time I know that they wished to patent the work; does anyone know if a patent were granted, and if so when it expires?<p>[1] <a href="https:&#x2F;&#x2F;www.schneier.com&#x2F;cryptography&#x2F;paperfiles&#x2F;paper-auditlogs.pdf" rel="nofollow">https:&#x2F;&#x2F;www.schneier.com&#x2F;cryptography&#x2F;paperfiles&#x2F;paper-audit...</a>