What can a log entry not prove?¶

On its own, a log entry usually cannot prove the human actor, motive, precise real-world time or final outcome. Those conclusions require understanding and corroboration.

Technical identifiers have limited reach¶

Accounts can be shared or compromised, endpoints renamed or virtual, addresses shared or translated, and sessions automated or reused. A displayed timestamp may reflect a wrong clock, another zone or ingestion. Status can concern only one stage, and an export may be filtered, normalised or enriched.

Define each unresolved proposition¶

Retain source record, surrounding events, configuration, field definitions and time basis. Use related logs, endpoint evidence, access-control records, communications and providers to test actor and outcome.

Avoid treating these limits as reasons to dismiss the log. They define what additional evidence is needed and the safe boundary of reporting.