Git history as a forensic and source-review artifact

Mechanism

Git records snapshots and references, not every historical filesystem state. Deleted secrets can remain in reachable commits, tags, reflogs, or objects even after removal from the current tree. A repository archive can also omit history entirely. Establish which objects and references are actually present before making recovery claims.

Practical method

Inspect status and references without modifying the repository. Review relevant file history and compare the commit where a value appeared with the commit that removed it. Record commit IDs and paths. Treat recovered credential-like material as evidence to redact, not values to paste into notes.

git log --all --oneline -- path/to/file
git show COMMIT:path/to/file
git diff OLDER NEWER -- path/to/file

Interpreting evidence

A historical value is tied to the object and commit that contains it. Current validity is a separate question and should not be assumed from its presence in history.

Pitfalls and limits

Rewritten history and shallow repositories limit coverage. A removed file may survive in another branch. Commit author dates and committer dates describe different metadata and can both be altered.