“Router logs document every connection in and out which provides the smoking gun as every connection provides the MAC address of each end device, nail meet coffin.”
And it keeps it for about 10 minutes.
Then it’s sent to the log server.
Great point...we also are assuming the log servers are even implemented and for how long logs are maintained...remember November was almost 6 months ago