When should a log line of enquiry stop?¶

A log line of enquiry should stop when further work is unlikely to change a material investigative decision, test a realistic alternative explanation or add proportionate evidential value.

More data is not always better evidence.

Avoid the dangerous assumption¶

The dangerous assumption is that every available log source must be collected and analysed before the enquiry can be complete.

That can waste time, cost and specialist capacity.

The line of enquiry may reasonably stop when the relevant proposition has been answered to the required level, the key records have been preserved and realistic alternatives have been considered.

It may also stop where retention has expired, the source never recorded the event, further acquisition would be disproportionate or the remaining uncertainty does not affect the case.

Investigators should define the question before collecting more logs. Are they trying to establish occurrence, sequence, account use, device involvement, outcome or attribution?

Review what is already known, what remains uncertain and whether another source is capable of resolving it. Do not continue merely because another dashboard or provider exists.

The decision should account for seriousness, risk, investigative stage, legal requirements, cost and the consequences of error. A minor unresolved timing difference may not justify specialist reconstruction, while disputed attribution in a serious case may.

Record why the line was closed, what records were examined, what limitations remain and what development would justify reopening it.

Stopping does not mean claiming certainty. It means the remaining uncertainty has been identified and judged against the investigative purpose.

Operational takeaway¶

Stop a log line of enquiry when the material question has been answered proportionately or further work cannot realistically alter the decision, while recording the residual uncertainty and reopening triggers.