An absence must have an expectation
A record is only meaningfully absent when a reasonable model predicts that it should exist. The model requires a defined event, an instrumented source, a known collection window, and a retention pathway. An empty folder, short log, or missing browser record without this context establishes little.
Consider a hypothetical workstation that has no local record of an alleged login during a particular hour. At least four different hypotheses deserve initial consideration:
- No login occurred.
- A login occurred but the configured audit source did not record that event class.
- The event was recorded but expired, rolled over, or was never acquired.
- Evidence was deliberately altered or removed.
The fourth hypothesis is not automatically privileged just because it makes a more interesting incident report. Each explanation predicts different additional observations.
Build an observability map
For every event under examination, record the expected producing subsystem, normal event class, enabled audit policy, clock source, retention interval, export method, access restrictions, and any upstream or downstream copy. For cloud records, document what the service actually exposes to the account and subscription tier. For mobile and application traces, note that interface views and downloadable exports may represent only a subset of backend state.
Build a second column for negative controls: innocuous activity known to have occurred in a comparable setting. If equivalent control events are frequently missing, the reliability of absence as evidence declines. Also record changes caused by the examination itself. A live system is not a museum specimen; acquisition can alter volatile state.
Test each competing explanation
| Hypothesis | Observable test | Interpretation limit |
|---|---|---|
| Event did not happen | Seek independent records capable of detecting that event | No independent record may mean no coverage, not no event |
| Source was not configured to record it | Inspect documented settings and comparable event classes | Settings observed now may not match settings at incident time |
| Retention or acquisition gap | Compare rotation policy, export scope, and earlier retained copies | A current retention policy may have changed |
| Interference with records | Look for independently corroborated change or preservation anomalies | Anomalies do not alone identify actor or intent |
Report the confidence boundary
A useful finding has three lines: observed (which source was searched, by whom and how), expected (why the artifact should have been present), and unknown (what other collection points or historic settings could change the conclusion). Record a competing explanation that would reverse the conclusion. If that explanation has not been tested, keep the assessment provisional.
For a reusable process, download the Evidence Dependency Worksheet and link each observation to the acquisition or source that supports it.
Related project
Anti-Forensics.com maintains a broader digital evidence and defensive counter-forensics reference. The technique library and artifact index offer subject-specific reading. The method here is an educational review procedure, not a validated study with published sensitivity or specificity estimates.
Source and revision record
Original editorial analysis and definitions. For background reference, consult the source catalog.