1. A method comprising: interrogating, with a forensic device, a target computing device to acquire a log file; executing, on the forensic device, a time analysis tool that analyzes the log file to detect log file tampering by receiving input from a user that identifies a period and an identifier for a periodic event, searching the log file for periodic event identifiers that match the identifier received from the user, computing time gaps between each of the periodic event identifiers within the log file, and comparing the period of the event as specified by the user with the computed time gaps within the log file to detect at least one absent periodic event; and displaying to a user the results of the analysis to alert the user of the absent periodic event.