Hacking Question Dirty Logs on the Switch - Can there be anything done?

[Kadji]

Ok, so last weekend my friend wanted to hack his switch.
I told him to read the guides on gbatemp and to use https://guide.sdsetup.com/ as a CFW installation Guideline.

Turns out he did not back up his NAND before doing anything CFW related.
On top of that he installed Celeste, but since he has no Sig Patches he could not start the game.
His switch was in airplane mode the whole time / had no access to the internet.

Now that he knows how much of a struggle it is to *not* get banned he wants to revert everything he has done.
But I had to tell him that his logs on the Switch are most likely dirty and that Nintendo will know that he has done something CFW related.

Now is there any way to fix those dirty logs? The only thing he did was to install celeste and try to start it, which did not work.
Would a full System Whipe be enough?

 

[TariqSoftDev]

Not much can be done, you see the logs are like this:

• Checked for continuinty between the ones Ninty has their side and your switch.
• Deleting all logs might cause Nintendo to realize.
• Not much can be done without a clean NAND.

You should've told him to do a full backup of his NAND before hand, it's the most basic first thing to do.

--------------------- MERGED ---------------------------

You could try making sure he leaves his switch offline for a very very very very long time and blanking the logs, Nintendo may just think it's the switch at fault and no modification was done.

 

[Kafluke]

You're friend needs to build a fresh clean nand using his PC. Someone will post you the link. I'm on my phone right now.

Once he has fresh clean nand build he can restore it and since it hasn't been online there will be no problems. Then he can start over and do it right.

 

[Rasa39]

Do dirty logs include crashlogs that are saved onto the sd card by atmosphere? Like are those logged directly onto the sd card, or are they recorded by the system/Nintendo first before atmosphere can pull them to the sd card?

Asking due to a similar situation as OP, if the crash logs were made while offline then saved onto the sd card, is it safe to delete some of them or can Nintendo still find the logs in the atmosphere folder?

You're friend needs to build a fresh clean nand using his PC.

You can do that now, is it similar to building 3DS nand or is it way more difficult?

 

[hippy dave]

Did he ever go online before hacking? If not, it might be safe to wipe the logs - find out for certain whether they're actually supposed to start off blank tho. If he had previously been online then Nintendo has previous logs so wiping wouldn't be good.

 

[ZachyCatGames]

Just nuke your system and user save data (except for 8000000000000120 and 8000000000000047 if it exists. Both are system saves) and nuke the Nintendo folder on your sd card

 

[Kadji]

Did he ever go online before hacking? If not, it might be safe to wipe the logs - find out for certain whether they're actually supposed to start off blank tho. If he had previously been online then Nintendo has previous logs so wiping wouldn't be good.

He obviously was online before using CFW (he has his switch for over a year now). Sorry if that was not clear.
TL DR
- Friend had his Switch for over a year now, used it online on a regular basis (mostly to play Splatoon 2), so Logfiles should be full of normal online activity
- Decided to hack it now that Online has a subscription cost, did not take his time to do a NAND dump
- Proceeded to install CFW whith no active internet connection
- Proceeded to install Celeste, which went through successfull
- Tried to start Celeste which failed, most likely because of missing Sig-Patches
- He then shhut his Switch off and contacted me

Is the Log a ascii based file which content can be modified?
My thinking was that only the very few last entrys in the Log need to be deleted. Is there any homebrew to look at the Logfiles and delete individual entrys? Or am I totaly wrong and the "logs" are indeed a single binary BLOB or something like that?

If there is no other way around we are ready to nuke everything from his switch, but he would of course prefere to keep his Data.
Thanks to everyone that posted thus far.

Kafluke also mentioned building a new, clean nand. What would be different from doing a full System whipe or deleting the whole log file in a CFW environement?
I don't understand how a full, new clean nand would help out in this situation.

 

[thaikhoa]

Factory restore settings while being offline will delete all logs/ ticketblobs. Trust me, I did it 100+ Switches and they've not banned yet.

 

[Kadji]

Ok, thank you very much - I will give him this information. It's his fault for skipping part of the guide after all.

EDIT: One more thing that I just remembered: We are talking about an european switch, so we can opt-out of some data collection (GPDR Settings). Does this help in any way?

 

[hippy dave]

Factory restore settings while being offline will delete all logs/ ticketblobs. Trust me, I did it 100+ Switches and they've not banned yet.

It's been repeatedly stated by the devs who know their way around the internals that factory reset doesn't clear logs.

Ok, thank you very much - I will give him this information. It's his fault for skipping part of the guide after all.

EDIT: One more thing that I just remembered: We are talking about an european switch, so we can opt-out of some data collection (GPDR Settings). Does this help in any way?

Yes the opt out seems to help to some extent, based on anecdotal evidence, but there doesn't seem to be enough info around to know exactly the difference it makes.

 

[thaikhoa]

It's been repeatedly stated by the devs who know their way around the internals that factory reset doesn't clear logs.


Yes the opt out seems to help to some extent, based on anecdotal evidence, but there doesn't seem to be enough info around to know exactly the difference it makes.

It cleans up everything from what I could see. You could even manually build a clean nand. So yea, if the devs said so there is no way back to origin without a clean nand backup or end up to sell the current one then buy a new one.

 

[linuxares]

Use the factory reset option in ChoiDeJourNX?