Thanks for a great explanation. Sounds like maybe he should have declined the invitation for that reason. Personally I pass on opportunities that are too far out of my forte.

One thing I wonder, as someone who doesn’t know the mechanics of these systems, is it possible these splunk logs are already in the hands of white hats? Kind of like the Mesa County, CO situation where someone made backups and has turned them over. Or is it possible white hat hackers could have copied them during the election?

The reason I ask is this seems like a game of cat and mouse. Similar to the way President Trump laid out the criminal acts in Georgia in his call with Raffensberger. It feels like the answers are already known. Could be wrong.