Does a log entry identify a person?¶

Rarely by itself. Logs identify accounts, endpoints, sessions, tokens or connections recognised by systems; a human attribution is built by showing who controlled those identifiers at the relevant time.

Identifier strength varies¶

A named account may be shared or compromised, a device used by several people, a session left active and an IP address shared by a household or service. Automation can act under personal-looking credentials. Individually issued accounts, managed endpoints, multi-factor events and physical access together can be much stronger.

Test issue, access and control¶

Ask how each identifier was assigned, whether it was unique, who could use it and whether compromise or delegation occurred. Compare endpoint examination, communications, CCTV, access-control, employment and witness records.

Report the technical association first and explain each corroborating link to the person.