I know over the years I've found myself occasionally saying, "With more digging, I think I could work out exactly..." This usually arises after I've been asked to figure out how a student or a COE got to be the way it is. For all of the desktop and tablet machines that periodically upload, we've always had very good evidence left around about who changed what when in the form of transaction files. Everything that came in from the field could only come in through these files, so whatever happened had to be contained in them somehow. It often took a good bit of digging, but we could pinpoint exactly what happened. But for changes made directly on the state system, we couldn't depend on this mechanism since the state doesn't upload to itself. But at the state level, we always had good backups that we could rely on to let us see when things changed, and since there are very few people who have direct access to the state, we could usually work out what happened ...