What is a transaction log?¶

A transaction log records a sequence of changes or operations carried out by a system.

Depending on the context, it may relate to payments, databases, applications, financial platforms or technical processes.

Avoid this assumption: That the word “transaction” always means a completed financial payment made by a person. It may mean something very different.

In a database, a transaction can be a group of changes committed or rolled back together. In a payment system, it may refer to authorisation, capture, settlement, refund or reversal. In an application, it may describe a technical operation rather than a financial event.

A transaction log may include a transaction ID, account or process, action, amount or object, status, timestamps and linked records. This can help reconstruct the order of operations and determine whether a change was attempted, accepted, committed, reversed or failed.

But status labels must be interpreted using the system’s own definitions. “Successful” may mean one stage completed while later settlement failed. “Pending” may later become completed or cancelled. A rollback may remove the final effect while leaving evidence that the attempt occurred.

The account or system recorded in the transaction does not automatically identify the person responsible. Automated jobs, APIs, compromised accounts and service processes may initiate transactions.

Investigators should identify what the system means by transaction and each status used. Ask whether the log records requests, processing stages or final outcomes. Preserve linked identifiers, surrounding events and any later reversals or corrections.

Correlate important entries with account, authentication, application, database and financial records. Where money or legal consequence is involved, obtain evidence of the final state rather than relying on an intermediate technical status.

Operational takeaway¶

A transaction log records operations and state changes defined by a particular system, so investigators must establish what stage occurred, what final outcome followed and who or what initiated it.