“Tamper-proof” is usually the wrong word. Any record stored on a machine somebody controls can be altered by somebody with enough access. The achievable property is weaker and far more useful: tamper evident. You cannot stop the edit; you can make sure it cannot happen quietly.
The mechanism, in three sentences
Serialise each event into a canonical form so that formatting differences cannot change the result. Compute its hash over that form together with the hash of the previous event. Store the hash with the event, starting from a genesis record.
That is the whole construction. Verification walks the chain from the genesis record forward, recomputing each hash. If an event was altered, its hash no longer matches, and every link after it fails too. The verification names the first break, which tells you where the record stopped being trustworthy.
Why not a blockchain
Distributed ledgers solve a problem this one does not have: agreeing on a history between parties who do not trust each other, without a coordinator. Here there is one writer, one machine and one owner. Adding consensus, a network dependency and a token to a local audit log buys nothing and costs availability, privacy and about two orders of magnitude in complexity.
If you need a third party to be able to verify your record without trusting your copy, the right tool is a signature, not a chain of blocks. Sign an export with a private key; the recipient verifies it with your public key. That is a solved problem with well understood key management, and it composes with the chain rather than replacing it.
What it proves, exactly
It proves: the events in this chain have not been altered or removed since they were written, or, if they have, here is the point where that happened.
It does not prove: that everything which happened was recorded. An agent running on a machine with no recorder leaves no trace and breaks no chain. That is a coverage question and it needs a separate answer — which is why unmonitored repositories should be listed as unmonitored rather than counted as clean.
Conflating those two is the most common way a tamper-evident record gets oversold.
Deletion as an event
One detail matters more than it looks. If deletion removes a row, the chain breaks and you cannot tell an authorised deletion from an attack. Instead, record the deletion as its own event — a tombstone carrying the original hash and, where given, a reason. The chain stays intact, the removal is visible, and a retention policy can archive rather than destroy.