# Forensics

> The ability to reconstruct after the fact what happened from an immutable audit record.

Record: `lex:forensics`
Kind: capability
Layer: [Observability](https://banes-lab.com/records/layer/observability.md)
Canonical: https://banes-lab.com/ontology/lexicon#lex-forensics

## category

- [Observability / Auditability / Traceability](https://banes-lab.com/records/lex-category/observability-auditability-traceability.md)

## referenced-by

- [Audit Logging](https://banes-lab.com/records/arch/audit-logging.md)