It states that the person needs to have all evidence in the recording, does that mean it's against the rules to say what ghost it is based on how its behaving, if its between to 2 evidences?

I assume that you are allowed to if it is impossible to have the other one? like if there's no fingerprints on a door you know the ghost opened?