What evidence may show movement between systems?¶

Movement is strongest when source and target records describe the same transition and its result. One connection event rarely proves the whole path.

Correlate both sides¶

Preserve source and target host IDs, accounts, protocol, session IDs, exact times and zones, commands, transfers and success results. The source may record a remote request while the target records authentication, process creation and a new file.

Shared session, job or correlation identifiers are preferable to timing alone. Account for clock drift, retries, gateways and relays before joining events.

State incomplete paths accurately¶

A target login without a source event can still prove access to the target while leaving the route uncertain. A source request without target acceptance may show only an attempt. Process, file and account changes can narrow the inference.

Missing evidence may reflect retention or coverage, but close timestamps are not enough to manufacture a link. Preserve the known event and explain which side or identifier is absent.