# Forensics

> The ability to reconstruct after the fact what happened from an immutable audit record.

Record: `lexicon:forensics`
Kind: capability
Layer: [Observability](https://banes-lab.com/records/layer/observability.md)
Canonical: https://banes-lab.com/ontology/lexicon#lexicon-forensics

Listed in [Lexicon terms](https://banes-lab.com/api/records/lexicon.md), after [Actor](https://banes-lab.com/records/lexicon/actor.md) and before [Privacy](https://banes-lab.com/records/lexicon/privacy.md).

## Category

- [Observability / Auditability / Traceability](https://banes-lab.com/records/lexicon-category/observability-auditability-traceability.md)

## Enabled by

- [Audit Logging](https://banes-lab.com/records/architecture/audit-logging.md)

## Linked from

- [Observability / Auditability / Traceability](https://banes-lab.com/ontology/principles/architecture-category-observability-auditability-traceability.md)