Comment by jen20

What's important is that the audit trail can be replayed to derive the state of the system - and preferably in such a way that investigators can determine what _would_ have been seen by someone using it on a specific day at a specific time. Whether the system is free from bugs is a different matter - no system is, which is why deriving state from the audit trail instead of a parallel process which is guaranteed to diverge is so important!