> so you delete everything and there's no 'valid' entry to compare anything to that will let you detect the gap.
If you deleted everything then I wouldn't need a "valid" entry to compare against; the simple lack of previous logs would be plenty suspicious by itself.