Dodgy Dave makes stock disappear but leaves the events behind¶
Dave works evening shifts at a distribution warehouse. He marks selected high-value items as damaged, moves them to a quiet loading bay and collects them after his shift. The stock disappears physically; the access, inventory and loading systems are rather more attached to it. This standalone theft scenario follows the events Dave's plan creates.
Dave discovers administrative shrinkage¶
Dave uses his legitimate staff account STF-4418 to change three tablets from available to damaged - dispose. He believes an authorised account makes the adjustment look authorised. The inventory system is less philosophical: it records the account, item, previous value, new value, terminal, session and time.
A username in an event does not identify the person at the terminal. It does give the next records something precise to test.
Dave sends the stock on a short final journey¶
Warehouse scanners record the same item IDs moving from secure aisle A-14 to disposal cage D-02, then to loading bay B-7. Session SES-6D20 performs the inventory changes and handheld device SCAN-14 records the moves.
The sequence is stronger than four rows sharing a date. Stable event identifiers and session identifiers, together with the scanner, item and location fields, describe a coherent movement that the ordinary disposal process does not explain.
Dave borrows a badge and keeps his own phone¶
Dave uses a colleague's door badge, hoping the access log will nominate somebody else. The badge event establishes use of credential DB-208; it does not prove its assigned holder opened the door. Door-camera footage shows Dave nearby, his shift record places him on the bay, and the warehouse Wi-Fi associates his enrolled phone with access point AP-B7 during the movement.
DB-208 opened bay door B-7The access system records the issued credential and event.Whether Dave used the badge during the stock movementFootage, rota, phone and possession evidence address the human act.The colleague's account remains relevant: investigators can test how Dave obtained the badge and whether the holder participated. The event should not be treated as either perfect attribution or useless noise.
The alert finds a pattern, not the whole theft¶
The warehouse detection rule flags items marked damaged and moved to an external bay without a disposal-manifest event. The alert is not the underlying evidence; it is the reason the source events are reviewed. Dave has not been convicted by a red icon.
The source records reveal eleven similar sequences on Dave's shifts. The pattern is operationally strong, but a recorded event does not prove a person caused it; each suspected incident still needs its own item, session, access and outcome evidence.
Dave's car completes the correlation¶
Vehicle-control logs record Dave's car entering the staff area before the shift and leaving seven minutes after the bay-door event. A later recovery finds item TAB-77104 in the vehicle, identified by its serial number. The car event does not prove the item was inside at exit; the recovered serial does not explain how it left the warehouse. Together with the inventory, scanner, door, rota and device records, they form a compelling sequence.
A device identifier and an IP address in a log do not identify a person by themselves. Here, personal attribution is built positively from recurring account use, shift presence, footage, phone association, vehicle movement and possession of the stock. How logged activity is attributed to a person is the larger evidential question.
