I have been given a log, event or provider return. What happens next?¶
Nadia Holt reports that Owen Kerr repeatedly appeared near private repair appointments and later messaged details held only in her housing-provider account. The provider supplies a spreadsheet of audit events showing contractor account CTR-2041 viewing her restricted tenant record. This walkthrough turns those rows into an evidential timeline and tests whether the account activity leads to Owen as a stalking suspect.
A username, workstation or successful login does not identify a human on its own. Repeated agreement between audit, authentication, physical-access, communication and device records can nevertheless provide a strong circumstantial case.
The material received¶
restricted-record-review.xlsx, produced by the provider's security team.TEN-50882, belonging to Nadia Holt.CTR-2041, issued to Owen Kerr.The workbook is useful, but it is a presentation created from several systems. It may sort, rename or omit fields. The difference between an event and a log entry matters here: Nadia's record was viewed; the audit entry is the housing system's representation of that view; and the spreadsheet is a further export of that representation.
CTR-2041.Work the records into an evidential timeline¶
01 · Identify the producing systems and original records
The workbook combines housing audit data, authentication events and door-access records; it is not the original record from any of them.
Record who produced the workbook, from which systems, using what filters and at what time. A log export may omit events or fields, so retain the original exports and their metadata where available. Preserving the source records allows later interpretation to be checked rather than treating a helpful spreadsheet as an unexplained oracle.
02 · Establish what the fields and times mean
The housing system distinguishes the event time from the later ingestion time and uses a stable tenant identifier rather than Nadia's displayed name.
VIEW_RESTRICTED_RECORD means the application returned Nadia's restricted record to an authenticated session. It does not prove every field was read or remembered. EXPORT_APPOINTMENT means the system generated a document; a separate download event addresses whether it left the application.
2026-06-03T08:13:09.441ZWhen the housing application says the view occurred.2026-06-03T08:13:14.806ZWhen the central logging service received the entry.Event time and ingestion time answer different questions. The trailing Z indicates UTC; time-zone interpretation becomes essential when comparing this entry with local door access, messages or witness accounts.
03 · Follow stable identifiers across the sequence
Session SES-A74C authenticates, views Nadia's record and exports her repair appointment within three minutes.
CTR-2041 on workstation WS-17; session SES-A74C begins.VIEW_RESTRICTED_RECORD for TEN-50882.REP-7714.REP-7714 delivered to workstation WS-17.Stable account, tenant, session, report and workstation identifiers create a defensible relationship between the events. Mere proximity in a spreadsheet would be weaker. A successful login establishes acceptance of the authentication, not the identity of the operator; that is the next proposition.
04 · Compare genuinely independent records
Owen's issued access badge enters the contractor office four minutes before session SES-A74C; Nadia receives a message quoting the appointment 19 minutes after the export.
The badge identifies an issued credential, not necessarily the person carrying it. The message identifies an account, not automatically its author. Their value comes from independent agreement on a distinctive sequence repeated across several dates. Owen's work rota and workstation assignment add further support; unrelated staff use does not appear in the relevant sessions.
05 · Test the logged activity against device evidence and conduct
A phone recovered from Owen contains Nadia's appointment export REP-7714, screenshots of her restricted record and messages sent shortly after the recorded views.
The report identifier and file hash match the provider download. The phone also contains the account used for the messages and photographs taken near two appointment locations. None of those facts needs the log row to prove its own existence; together they strongly corroborate that the housing access was used as part of the reported stalking conduct.
This combination moves well beyond “Owen had an account”. Repeated relevant-time badge access, one workstation and session, targeted record views, matching downloaded material and closely timed communications all point towards Owen. An IP address in a log would not identify him, and neither does a username. Attributing authentication events to a person is built through the wider agreement.
