Abstract
The fundamental purpose of record keeping is to preserve accurate details of events and establish solid proof that the events have occurred. Trustworthy records are, therefore, those that can be relied upon to provide irrefutable evidence of all the events that have been logged. Such records must be managed from an end-to-end perspective, beginning with their preservation, and including their subsequent discovery and delivery to an agent seeking proof or details of an event. The current limited focus on storing electronic records in WORM storage is increasingly inadequate to ensure that such records are trustworthy. In particular, given the high stakes that could be involved in tampering with the records, the WORM storage must be secure against attacks, even those from the inside. Furthermore, the WORM storage must be used in such a way as to allow all records that are relevant to an inquiry to be quickly found without being vulnerable to logical modification. In addition, these records must be protected against any alteration after they are retrieved from the WORM storage and before they are delivered to the inquiry agent. We use the term Fossilization to describe a holistic approach to storing and managing records that ensures the records are trustworthy. Fossilization is composed of three parts. The first, Fossilization of storage, ensures that all the records and their associated metadata are securely protected from any loss or modification. The second, Fossilization of discovery, ensures that every preserved record which is pertinent to an inquiry can be readily located and retrieved in a timely fashion, and the third, Fossilization of delivery, warrants that exactly the records retrieved from storage are delivered to the agent and that the records are delivered unaltered. © 2007 IBM.