I have no knowledge of how the CAs maintain the CT logs.

What is the process for a CA to rebuild the CT log, if one exists? Is it something like what is illustrated below?

Let CA1, CA2, CA3 and CA4 be different certificate authorities. The set enumerated alongside each CA is the set of certificates logged into its CT log.

  CA1 : {c1, c2, c3}

  CA2 : {c2, c3'}

  CA3 : {c1, c2}

  CA4 : {c1, c3}

Suppose CA2 is where an issue was detected with certificate c3 (the anomalous cert is denoted by c3') and CA2 trusts CA3 and CA4, then the set {c1, c2, c3} can be constructed after verifying the CT logs of CA3 and CA4 and merging their logs.

Is that kind of how it would work or would CA2 just truncate its log and restart from this point forward?