Does a recorded event prove that a person caused it?¶

No. A log establishes that a system recorded an event or state change. Linking that event to a particular person's action or intention requires additional evidence.

The recorded actor may be a technical context¶

Operating systems, background services, scheduled tasks, scripts, APIs and synchronisation processes all generate events. An account name may identify the security context in which software ran, not a person who was present and acting at that moment.

Even apparently interactive events need interpretation. A valid session could be shared, left open, remotely controlled or used through delegated access. One human input can also trigger many automatic downstream records.

Attribution needs a supported chain¶

Identify the component that created the event and its normal triggers. Process ancestry, session and request identifiers, authentication records, device evidence and surrounding application or network activity can help distinguish direct interaction from automation.

Describe the technical observation first - for example, that a command was recorded in a particular session. Any conclusion about who controlled that session, whether the action was deliberate and what the person knew should be stated as a separate, evidence-based inference.