Do you have the original record?¶
title: "Do you have the original record?" card_id: "IP-016" status: "complete" source_document: "https://docs.google.com/document/d/1VRBbNZQJehE3M4PrCgM7GN8NZEbG7Op7vM8sT3U_C0A/edit?usp=drivesdk"
Do you have the original record?¶
Once you know where an IP address came from, establish what record you actually have.
Do you have information obtained directly from the system that recorded it?
An export produced from that system?
A screenshot?
A summary written by somebody else?
Or simply an IP address copied into an email or report?
Those aren’t the same thing.
The closest available record from the originating system will usually give you the best opportunity to understand what was recorded.
That might be a platform return, a log export, a downloaded report or data obtained directly from the system itself.
It doesn’t necessarily mean having access to the original database or server.
In many cases, an export produced by the system is the practical record you’ll work with.
The important point is that you can establish where it came from, how it was produced and what information accompanied the IP address.
A screenshot may still be valuable.
It might capture information that would otherwise disappear.
It may show what a victim, customer or member of staff could see at the time.
And it may accurately reproduce part of a platform or system record.
But a screenshot can also leave important questions unanswered.
It may not show the name of the system.
Field labels may be missing.
The timestamp or time zone may be cropped out.
You may not be able to see the surrounding entries.
And you may not know whether the image shows the complete record.
That doesn’t make the screenshot worthless.
It means you need to describe it as a screenshot and understand its limitations.
A written summary or copied IP address takes you another step away from the source.
Someone may have selected the address, copied it incorrectly, misunderstood the field or described the activity more strongly than the record supports.
For example, an email might say:
“This is the IP address used by the offender.”
But the underlying record might only show an unsuccessful login attempt against an account.
Or it might show an address taken from an internal system rather than the public source of a connection.
Until you see the underlying material, you don’t know.
Your wording should reflect what you actually have.
If you have a direct platform return, you might say:
“The platform return records this IP address in connection with the event.”
If you have a screenshot, say:
“A screenshot supplied by the account holder displays this IP address.”
If all you have is somebody’s description, say:
“The information supplied states that this IP address was associated with the event. The underlying record hasn’t yet been obtained.”
Don’t silently upgrade one type of material into another.
If a fuller or more direct record exists, obtain it before relying on somebody else’s interpretation.
If it no longer exists, retain what is available and record the limitation.
A screenshot, export or summary may still provide a useful lead.
But you need to know which one you’re dealing with.
Before moving on, be able to explain:
What material you have.
Where it came from.
And whether it represents the originating record or somebody else’s version of it.
Then you can assess what event it actually shows and how much weight that information should carry.