I am interested in how reliable the information determined from doing forensics on a SOHO router is. Most of these routers don't seem to be very advanced, so I question if it would be possible to detect tampering.
If logfiles had been changed for example, could this be detected? Given that they use flash memory, would there be remnants of previous incarnations of the file to sue as evidence?
If you need to make a case that a SOHO router was tampered with in any way, what steps could you take to establish this and then what would you provide as evidence?