Really interesting! It's sobering to think about the ways that even in a system not set up for logging you can trace back through these actions. I was asked to

Really interesting! It's sobering to think about the ways that even in a system not set up for logging you can trace back through these actions. I was asked to figure out what had happened on a system where some data had changed and 2 parties were blaming each other. After about a hour digging around I managed to piece together a picture of how Person X had got up on a Monday morning, discovered (on their mobile, home wifi) that they had made a mistake on Friday, then logged in on their desktop to fix it from home (first time they logged in at home), then went to work and blamed someone else. What was remarkable was how many different sources there were to pick up bits and pieces from. In isolation there wasn't much to go on, but once you start the connecting the parts, it's really incriminating.