LOGFLIP Analysis Report

Verdict

INCONCLUSIVE
evil_confirmed: false - not all gates passed

Timestamp Comparison

Before (original $SI)
N/A
After (tampered $SI)
0040a7e3a36bc9010040a7e3a36bc90176d9560916f6dc010040a7e3a36bc90120000000000000000000000000000000000000000d01000000000000000000006004000000000000

Evidence Records

logfile_reverse_replay
record_type: logfile_reverse_replay
inversion_complete: False
walked_lsn_count: 1
si_vs_fn_delta
record_type: si_vs_fn_delta
si_fn_delta_nonzero: True
si_created: 128752416000000000
fn_created: 134252663392703686

Trace Timeline

#0
disagreement
reverse_replayer
target_mft_record=24, recovery=best_effort
#1
agent_revision
router
trigger=best_effort_recovery, reconstructed_len=72, in_image_len=72
#2
close
leaf_emitter
evil_confirmed=False, tool_family=

Scope Disclaimer

Limitations of This Analysis
The $LogFile/$UsnJrnl rollover window is 4-12h on active volumes. By contrast, median attacker dwell is 10+ days; post-incident imaging delay is 24-72h or more. Therefore long-dwell coverage is NOT claimed; scoped to within-rollover-window events.

Provenance

db_content_hash (SHA-256 of fingerprint DB)
2b8d87f73809b167dcbf4789cc2f630ce1c5d8ca3f232f0b5e806d70e4dcaf04
leaf HMAC (RFC 8785 canonical)
059d042626b2aa11640526d69c56f05cf39a4bc1b3e7e94e343393819ba5506a

Best-effort recovered $SI (provisional)

Best-effort, NOT cryptographically confirmed

Strict reverse-replay inversion did not complete on this capture, so this pre-tamper $STANDARD_INFORMATION value is recovered by a best-effort, redo-consistent path anchored on the CreationTime field. It is provisional evidence and is NOT a confirmed reconstruction.
recovered CreationTime:c614ac0716f6dc01
recovered $SI (hex):c614ac0716f6dc011477ae0716f6dc011477ae0716f6dc011477ae0716f6dc0120000000000000000000000000000000000000000d01000000000000000000002002000000000000