Detecting edited audit content without rewriting the evidence

Find why an edited audit entry passes verification, then review a repair against the investigation console.