Agent forensics in five minutes: what it did, and proof the log wasn't edited
An agent incident ends one of two ways. Without an audit trail, you guess: what it did, when, with which arguments, under which policy, approved by whom. With a hash-chained audit, five minutes gets you a full timeline — and a way to show the timeline itself hasn't been edited since. I run agents on my own laptop (Claude Code, Cursor, OpenClaw, DSH), so I've had this happen. Here is the whole…
An agent incident has two outcomes: without an audit trail, it's a guessing game regarding what happened, when it occurred, what arguments were used, which policies were in effect, and who approved it. However, a hash-chained audit provides a full timeline in just five minutes, allowing you to prove that the timeline itself hasn't been altered since.
The script, run on the user's own laptop (Claude Code, Cursor, OpenClaw, DSH), includes steps to replay the timeline, verify the log hasn't been tampered with, and package the evidence for easy sharing. The hash chain approach ensures that even if an historical entry is edited, verification will fail immediately, providing stronger evidence that the log remains unmodified.
The entire process is portable, verifiable, and requires no trust in the machine handling the evidence.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
