Does the absence of a log entry prove that an event did not happen?¶

No. The absence of a log entry does not automatically prove that the event did not happen.

It proves only that no matching record was found in the material examined.

Avoid the dangerous assumption¶

The dangerous assumption is that every relevant action would always create a visible and retained log entry.

That is unsafe.

The system may not have been configured to record that event type. Logging may have been disabled, filtered or limited to failures, administrators or particular devices. The event may have been recorded elsewhere, delayed in collection or overwritten when storage filled.

A process can also fail before the logging stage. A device may be offline. A collector may miss the record. A cloud service may retain the data only for a limited period or licence tier.

Investigators should first establish whether the event would normally be logged by that system. Ask which component would create the record, whether logging was enabled, what retention applied and whether the searched dataset was complete.

Check surrounding records, source-system health, collector status and alternative sources. An application may have no event while the server, identity provider, endpoint or network system records part of the same activity.

Absence can still be relevant. If a well-understood system reliably records every successful action and the complete source records are available, the lack of an entry may weigh against the event having occurred.

But that conclusion must be supported by evidence about coverage and reliability, not assumption.

Operational takeaway¶

The absence of a log entry is not proof that an event did not occur unless investigators establish that the event should have been recorded, retained and present in the complete material examined.