[StressedDev]

That tells me either the attacker either removed the access from the logs OR the attacker figured out how to access the HAR file without having the access recorded in the logs.

[dannyw]

All this says is that the support engineer didn't access the file. It doesn't say the attacker wasn't logged accessing it.