Does a download record prove the file was opened?¶

No. A download record shows that the service handled a request to transfer content to a browser, device, application or other destination. Opening the resulting file is a later event that the cloud provider may not see.

Establish what “download” means in this service¶

The recorded event might represent:

• creation of a temporary download URL;
• the start of a transfer;
• successful delivery of all content;
• retrieval by a synchronisation client; or
• an application fetching content through an API.

Status, byte count, client type and outcome fields can distinguish these. A generated link with no subsequent transfer is different from a completed 24 MB response.

At 14:06 OneDrive records a successful download of plans.pdf, object OBJ-8821, by session SES-41C2; bytes_transferred=25165824. Dave's Surface download database records the same filename and source at 14:06. Adobe Acrobat then records the local path in its recent-file list at 14:11. The provider event establishes transfer, while the later application record advances the separate opening question.

Follow the receiving side¶

If a device is available, the download path, browser database, sync log and file metadata may show where the content went. Application recent-file records, preview caches or a later save can support opening. Subsequent editing, quoting or sending the content may provide stronger evidence of use.

Automatic transfer remains possible. A synced folder can retrieve files in the background, a browser can cache content, and an authorised application can process it without presenting it to a person.

Absence needs context too¶

Failure to recover a local copy does not disprove the provider event. The file may have been deleted, saved to another device, held temporarily, encrypted by an application or transferred through a remote session. The provider and device observations should each be stated at their own level.

The next useful records are the provider outcome and byte count, browser or sync transfer database, local path and content hash, application activity and the session or device controller.