What is a physical-access or door-entry log?¶

A physical-access or door-entry log records events generated by systems controlling entry to buildings, rooms or restricted areas.

It may record cards, fobs, mobile credentials, PINs, biometric checks, door sensors and access-control decisions.

Avoid this assumption: That a successful entry record proves the named person personally passed through the door. It does not.

A typical record may include the credential identifier, assigned holder, reader or door, access result, event type and timestamp. It can help establish that a credential was presented and accepted at a particular access point.

But the system usually identifies the credential, not the person carrying it. Cards and fobs can be loaned, stolen, duplicated or passed back. One authorised person may hold a door open for another. A door may be forced, left open or entered through another route.

The event wording also matters. “Access granted” may mean the lock was released, not that the door opened. A door-open sensor may show movement but not how many people passed through. Anti-passback and occupancy functions may be disabled or unreliable.

Investigators should identify the access-control system, credential assignment history and exact reader location. Ask whether the door had sensors, CCTV coverage, reception records or visitor controls. Establish the system time, time zone and any known clock drift.

Preserve the original event export, field definitions, cardholder records, access permissions and relevant system configuration. Correlate significant entries with CCTV, alarms, workstation logins, Wi-Fi, vehicle access and witness evidence.

Avoid describing the named cardholder as present unless the wider evidence supports that conclusion.

Operational takeaway¶

A physical-access log can show that a credential or sensor generated an event at an access point, but it does not by itself prove who entered, how many people passed or why.