On the forensic validity of approximated audit logs