Does access to a shared link identify the person who used it?¶
No. Access to a shared link does not, by itself, identify the person who used it.
A shared link may be sent to one person and then forwarded, copied, posted elsewhere or opened on a shared device.
What this may show¶
If the link requires sign-in, the provider may record an account identifier. If it does not, the provider may record only an IP address, browser information, time and link activity.
Those records can help narrow the enquiry, but they have limits.
What this does not show on its own¶
The dangerous assumption is that the intended recipient must be the actual user.
An IP address identifies a connection, not a person. A device name or browser fingerprint may not uniquely identify a physical device. Security scanners, preview services and automated systems may also access the link without a person deliberately opening it.
A named account accessing the link still does not automatically prove which person was using that account at the time.
Do not create new access events unnecessarily by opening a live link during the investigation. Preserve the link details and provider records first where possible.
Use careful language. The evidence may show that the link was accessed from a particular account or connection. It may support attribution when combined with other evidence, but it rarely establishes identity alone.
What to do next¶
Look for the exact link, creation record, recipient list, permissions, expiry and whether authentication was required.
Compare access records with communications showing who received or forwarded the link, device evidence, account sessions and wider circumstances.
Key takeaway
Shared-link access identifies an account or connection at best, so corroborate the user through communications, devices, sessions and wider evidence before attributing the activity.