Do you have the original record?¶

Get as close as you reasonably can to the system that recorded the IP address. The best available record will usually contain the labels, times and event details needed to use it properly.

This does not mean you need the original server or database. A reliable export or return produced by the originating system may be exactly what you need.

What do you have?¶

Material	How to use it
System export, platform return or downloaded report	Use as the main working record and retain its structure and labels
Screenshot	Preserve it, then seek a fuller export if important fields are missing
Written summary	Use it as a lead and obtain the underlying record where possible
IP address copied into an email or note	Go back for its source, timestamp, field label and event context

Check the essentials¶

Look for:

• the name of the system;
• the complete event or log entry;
• field labels;
• the full date, time and time zone or UTC offset;
• surrounding entries where they help explain the event; and
• details showing how the record was obtained or exported.

What information should come with an IP address? gives the fuller field list.

If you only have a screenshot¶

A screenshot may preserve something important and can still be a useful record. Keep the image as supplied and note who captured it, when and from which system or account.

Check whether anything has been cropped out, particularly:

• field names;
• timestamps and time zones;
• event status;
• account or session identifiers; and
• surrounding records.

If those details matter, ask for an export or fuller capture.

If you only have a summary¶

Find out who produced it and what they used. Ask for the underlying material while it is still available.

Record what you currently have in straightforward language:

• “The platform return records this IP address during the event.”
• “A screenshot supplied by the account holder displays this address.”
• “The supplied report associates this address with the event; the underlying system record has been requested.”

Preserve first if time matters¶

If the record may be deleted or overwritten, preserve the relevant material before spending too long perfecting its interpretation.