The attacker can prove what they took. You can only prove what you logged