Ghost Protocol — evidence you can inspect

Investigative aid only. This report does not determine responsibility or guilt. All data is fictional.

01 Scope & case context

CASE-001 · Warehouse equipment incident. Asset EQ-4471 recorded as secured at 21:00 and found missing at 22:00.

Incident window 21:00–22:00 site time (UTC+01:00), 2026-10-10.

ID	Source	Type	Integrity
E-01	Entrance CCTV	video	Simulated extraction, no file
E-02	Loading-bay CCTV	video	Simulated extraction, no file
E-03	Door alarm audio	audio	Simulated extraction, no file
E-04	Door access log	csv	SHA-256 0f0295fbd9ed…
E-05	Inventory event log	csv	SHA-256 4abb9b3f7503…
E-06	Witness statement	pdf	Simulated extraction, no file

Normalized	Source time	Event	Citation	State
21:00:00	21:00:00	EQ-4471 recorded as secured	E-05 · row 3	Supported
21:09:00	21:09:00	LOADING-BAY door opens (badge B-117)	E-05 · row 7	Contradicted
21:10:00	21:10:00	Person enters loading area	E-01 · timecode 00:14	Supported
21:12:00	21:12:00	LOADING-BAY door opens (badge B-117)	E-04 · row 18	Supported
21:12:00	21:14:00 (-120 s)	Loading-bay door opens on camera	E-02 · timecode 00:17	Supported
21:14:00	21:16:00 (-120 s)	Trolley moves through bay; object on trolley obscured	E-02 · timecode 00:39	Supported
21:16:00	21:16:00	Door alarm sounds; likely the loading-bay door	E-03 · timecode 00:52	Inferred
21:16:00	21:18:00 (-120 s)	Alarm beacon above the bay door flashes	E-02 · timecode 01:17	Supported
~21:18:00	21:18:00	Worker reports hearing movement near the bay	E-06 · page 2, para 3	Unresolved
22:00:00	22:00:00	EQ-4471 recorded as missing	E-05 · row 12	Supported

C-01 · Copied log out of sequence RULE-DUP-001
E-05 row 7 matches E-04 row 18 on badge, door and event code but is stamped 21:09:00 instead of 21:12:00 — before the first person enters at 21:10:00 (E-01). Possible copy or import error; not proof of tampering.
Uncertain: Whether the copy was produced by an import job, a manual edit, or a genuine second event.
C-02 · Camera clock offset · E-02 RULE-TIME-002
E-02 (Loading-bay CCTV) clock runs 120 s fast, inferred from 2 moments it shares with reference-clock sources: EV-013 at 21:14:00 vs EV-012 (E-04) at 21:12:00, +120 s; EV-017 at 21:18:00 vs EV-016 (E-03) at 21:16:00, +120 s. The estimates agree exactly. 3 events are normalized by -120 s. Original times are preserved.
Uncertain: Whether the offset held outside the anchored moments, and whether each anchor pair really records the same moment.
C-03 · Identity not established RULE-CLAIM-001
No source supports "The person in E-01 is the holder of badge B-117" (CL-04).
Uncertain: Who the person is. Appearance on camera does not establish identity.

H-01 The copied row is an import artifact Inferred
Field-for-field match with E-04 row 18 except time; import job log not available.
H-02 The copied row was edited after export Unresolved
E-05 has no edit history; this can be neither confirmed nor ruled out.
H-03 A genuine second door event at 21:09 Contradicted
E-04 has no 21:09 row; E-01 shows no entry before 21:10.

CL-04 The person in E-01 is the holder of badge B-117
No source links the person on camera to a badge.
CL-06 EQ-4471 was on the trolley
The object on the trolley is obscured in E-02.

Log files (CSV) are parsed deterministically; video, audio and PDF extraction is simulated from seed metadata in this demo.
Source times are never overwritten. Normalized times are derived and carry the rule that produced them.
The E-02 clock offset is inferred from two anchor moments it shares with reference-clock sources (RULE-TIME-002). The anchor events themselves are simulated from seed metadata.
Conflicts come from deterministic rules with stable IDs. A conflict is a prompt for review, not proof of tampering.
Results on a small synthetic case say nothing about accuracy on real investigations.