Skip to main content
Logs, records and provider evidence

I have been given a log, event or provider return

Establish which system produced the record, what each field means, which clock supplied the time and how the export was created before joining rows into a timeline or attributing activity to a person.

Investigate now

Start with what needs doing now

Use this route to preserve source records, test the export and turn events from different systems into a defensible evidential sequence.

Start the investigationWork through a log or provider return

Move from supplied rows to provenance, field meanings, timestamps, correlation and careful attribution.

Reference LOG-000Preserve firstWhat should I preserve with log evidence?

Retain source records, metadata and the context required to explain the export.

Reference LOG-012Clarify the sourceWhat should I ask the person who supplied the logs?

Establish the producing systems, filters, field definitions, time basis, omissions and method of export.

Reference LOG-013
Learn

Understand the evidence and the offender method

Use this route to understand what a log entry represents and see how separate event sources expose an offender's physical activity.

Foundation explanationWhat can a log entry actually show?

Separate the real event, the system's record and any later export or analyst interpretation.

Reference LOG-001Separate offender exampleDodgy Dave makes stock disappear but leaves the events behind

See inventory, access, scanner and vehicle events combine around a separate warehouse-theft operation.

Reference LOG-157
Common questions

Go directly to the issue you need to resolve

CompletenessCould an export omit fields or records?

Treat a polished spreadsheet as a produced view until its scope is explained.

Reference LOG-038TimeWhat does a timestamp actually prove?

Identify the clock, time meaning, precision and possible delay.

Reference LOG-056CausationDoes a recorded event prove that a person caused it?

Separate system activity from the account, device and human behind it.

Reference LOG-072AttributionDoes a username in a log identify the user?

Use the account field as a proposition to test, not a completed identification.

Reference LOG-009
Browse every Logs, records and provider evidence guidance page The complete reference library remains available when you need a narrower question.