[frenchtoast8]

This was my understanding as well, but earlier I couldn't find any documentation to prove this so I never wrote a comment.

CloudTrail can be configured to save logs to S3 or CloudWatch Logs, but I think that even if you were to disable, delete, or tamper with these logs, you can still search and download unaltered logs directly from AWS using the CloudTrail Events page.