I think there's more to this question.

a) can the redo/achlogs be modifed by spurious activity from a connected Oracle client? - NO.

b) can the redo/archlogs be modifed by some editor? - YES, they are just files after all. Access to these files should be limited by OS security to admins only (and I suspect that online redo can't be modified in Windows while the DB is up - OS file locking).

c) will logminer detect that an external change has been made to a log? - I don't know. I would hope so (missing SCN's?) - I suspect you'd have to be bloody clever to fool it.


As for the question of changes made NOLOGGING - can someone remind me how that's recorded in the data dictionary? If changes had been made nologging, you would have had problems doing the recovery.