Doctoring logs in ACP?

jeltz · Post by **jeltz** » Thu Feb 14, 2013 12:15 pm

Finally joined after having read the forums many times! So hello all.

I have an issue on a forum that I and 4 others administer.

One of the admins has accused one of the rest of us of making alterations to his posts and doctoring the logs in the ACP to hide the fact. Personally I don't think that's possible but before I tell him so, I want to know for sure. After all if we do have a rogue admin the rest of us want to know.

Post by **KevC** » Thu Feb 14, 2013 12:26 pm

If someone edits a post it shows up in the maintenance tab > moderator log, saying who carried it out and which topic was edited and when.

You can delete that log entry. But then the admin log says Cleared moderator log next to the name of the person and the time.

If you try and cover your tracks by deleting that record it then says Cleared admin log next to the name of the person and the time.

You would need access to the database to clear it with no record.

jeltz · Post by **jeltz** » Thu Feb 14, 2013 1:04 pm

Thanks,

Editing the database would require logging into the server then. Hopefully there will be sign in logs available to show the IP address of anyone who has done that recently. The guy who claims this has been done is the only person who would normally be looking after the DB.

So unless someone had the presence of mind to use a proxy then it should be easy to find.

I assume that they would have had to download the forum make changes and upload it again, sorry if this is a daft question but although I "get" the principle I don't have the practical knowledge of how it would be done.

Post by **KevC** » Thu Feb 14, 2013 1:13 pm

jeltz wrote: I assume that they would have had to download the forum make changes and upload it again, sorry if this is a daft question but although I "get" the principle I don't have the practical knowledge of how it would be done.

No, they would just log in to the database server, go to phpmyadmin and delete the right line of the _logs table.
It's a lot of effort to cover up a couple of simple post edits though.

Pony99CA · Post by **Pony99CA** » Thu Feb 14, 2013 10:51 pm

If a post is edited, isn't there an "Edited by..." entry in the post? That can't be cleared by clearing the logs, right? You would have to have database access to the delete those. (Technically, you could restore the database to a previous version, but that would just revert his post back to what it was.)

Steve

Post by **KevC** » Thu Feb 14, 2013 10:57 pm

Pony99CA wrote: If a post is edited, isn't there an "Edited by..." entry in the post?

Only if you have it turned on in the post settings. I have a funny feeling there are some other associated characteristics with that too such as who did the edit and the time frame but I can't remember what they are.

Pony99CA · Post by **Pony99CA** » Fri Feb 15, 2013 2:58 am

Kevin Clark wrote:
Pony99CA wrote: If a post is edited, isn't there an "Edited by..." entry in the post?
Only if you have it turned on in the post settings. I have a funny feeling there are some other associated characteristics with that too such as who did the edit and the time frame but I can't remember what they are.

Even if it's not turned on, does it still save that information in the posts table (in case somebody does turn it on later)? If so, the paranoid admin could check those fields and see who edited his posts (unless somebody erased the logs and that information in the database).

Steve

Post by **KevC** » Fri Feb 15, 2013 9:32 am

Yes it looks like there are 5 post edit fields in the posts table. It's a heck of a secret agent job to go and do all of that though!

HGN · Post by **HGN** » Sun Feb 17, 2013 2:33 am

AFAIK an edit is not stored in the posts table in case it is the last post of a topic and in case it is a moderator editing the post. When editing a post as moderator it will only show edited if a reason is entered during editing.

Still the moderator logs will show the post is edited.

advertisements