We are due to roll our system (including ES) out to our production servers in the next few months. Due to the business we are in our systems will be audited and are likely to be asked about the data we hold on disc, why it can’t be changed, what technology is being used to ensure the data in events is immutable etc.
Is there any documentation that may describe this for ES or could you explain this?
Thanks
The chances are the data can be changed.
Unless you’re writing to WORM media, nothing stops an operator with a hex editor going to town on your database files. If they want to, they can make the changes look legit by manually recalculating checksums too (I had to do this to a number of databases one time when Azure had a global storage outage and truncated files on page boundaries).
James
I imagined each event being chained on, so if the chain got interupted / tampered with, it would invalidate the stream?
Not on disk unless you run on a worm drive.
if not clear yes it is as you describe and there are checksums but you
can with access to disk change them!