Could remote access make activity appear local?¶

Yes. Remote access can make activity appear to have been carried out directly on a device even when the person controlling it was elsewhere.

That matters whenever local device logs are being used to infer physical presence.

Avoid this assumption: That activity recorded on a computer proves that the person was sitting in front of it. It may not.

Remote desktop tools, support software, command-line services and remote-management platforms can allow another device to control the system. Once connected, the resulting file access, application use, commands and settings changes may be recorded as local activity on the target machine.

The logs may show the target device’s username, process and local file path without clearly identifying the remote operator. Some remote-access tools create separate session records, while others blend activity into an existing user session.

Investigators should identify whether remote-access software or services were installed, enabled or active. Ask whether the organisation uses legitimate support tools and whether administrators can connect without the user accepting each session.

Preserve remote-access logs, authentication records, source IP addresses, session IDs, process events and administrator audit data. Look for connection start and end times and compare them with the disputed activity.

Remote access does not automatically explain every event. The user may also have been present, or malware may have controlled the device. Attribution requires correlation with network, account, device and other case evidence.

Use careful language. It may be accurate to say that activity occurred on the device while remaining uncertain whether it was initiated locally or remotely.

Operational takeaway¶

Remote access can produce apparently local activity on a target device, so investigators must examine connection and session evidence before treating device logs as proof of physical presence or direct local control.