# Investigation report · CASE-001

_Generated 2026-10-25T10:19:35.811415Z · model 1.0_

> Investigative aid only. This report does not determine responsibility or guilt. All data is fictional.

## 01 Scope and case context

- **Case:** CASE-001 · Warehouse equipment incident
- **Summary:** Asset EQ-4471 recorded as secured at 21:00 and found missing at 22:00.
- **Incident window:** 2026-10-10 21:00:00 – 22:00:00 site time (UTC+01:00)
- **Status:** active
- **Data:** Fictional demo case

## 02 Evidence inventory

| ID | Item | Type | SHA-256 | Ingested at |
| --- | --- | --- | --- | --- |
| E-01 | Entrance CCTV | video | No file | 2026-10-11T09:00:00Z |
| E-02 | Loading-bay CCTV | video | No file | 2026-10-11T09:00:00Z |
| E-03 | Door alarm audio | audio | No file | 2026-10-11T09:00:00Z |
| E-04 | Door access log | csv | 0f0295fbd9ed1f2e272fbb6bf60d7febeeeab30abde921e0096864015b3f7647 | 2026-10-11T09:00:00Z |
| E-05 | Inventory event log | csv | 4abb9b3f750338d4b418a37d82aa1cfd0c417c6408cacf9d33a4a5d06625ede6 | 2026-10-11T09:00:00Z |
| E-06 | Witness statement | pdf | No file | 2026-10-11T09:00:00Z |

## 03 Reconstructed timeline

| Event | Source time → Normalized time | Rule applied | Claim state | Source locator |
| --- | --- | --- | --- | --- |
| EV-001 | 21:00:00 → 21:00:00 | reference_clock | supported | E-05 · row 3 |
| EV-009 | 21:09:00 → 21:09:00 | reference_clock | contradicted | E-05 · row 7 |
| EV-011 | 21:10:00 → 21:10:00 | reference_clock | supported | E-01 · timecode 00:14 |
| EV-012 | 21:12:00 → 21:12:00 | reference_clock | supported | E-04 · row 18 |
| EV-013 | 21:14:00 → 21:12:00 | clock_offset:-120s (source clock 120s fast); inferred from anchors | supported | E-02 · timecode 00:17 |
| EV-014 | 21:16:00 → 21:14:00 | clock_offset:-120s (source clock 120s fast); inferred from anchors | supported | E-02 · timecode 00:39 |
| EV-016 | 21:16:00 → 21:16:00 | reference_clock | inferred | E-03 · timecode 00:52 |
| EV-017 | 21:18:00 → 21:16:00 | clock_offset:-120s (source clock 120s fast); inferred from anchors | supported | E-02 · timecode 01:17 |
| EV-018 | ~21:18:00 → ~21:18:00 | reference_clock; approximate ±120s | unresolved | E-06 · page 2, para 3 |
| EV-020 | 22:00:00 → 22:00:00 | reference_clock | supported | E-05 · row 12 |

## 04 Conflicts and rules

**C-01**
- **Rule:** RULE-DUP-001
- **Type:** copied_record
- **Severity:** high
- **Evidence involved:** E-04, E-05
- **Explanation:** E-05 row 7 matches E-04 row 18 on badge, door and event code but is stamped 21:09:00 instead of 21:12:00 — before the first person enters at 21:10:00 (E-01). Possible copy or import error; not proof of tampering.
- **What the rule cannot tell us:** Whether the copy was produced by an import job, a manual edit, or a genuine second event.

**C-02**
- **Rule:** RULE-TIME-002
- **Type:** clock_offset
- **Severity:** medium
- **Evidence involved:** E-02
- **Explanation:** E-02 (Loading-bay CCTV) clock runs 120 s fast, inferred from 2 moments it shares with reference-clock sources: EV-013 at 21:14:00 vs EV-012 (E-04) at 21:12:00, +120 s; EV-017 at 21:18:00 vs EV-016 (E-03) at 21:16:00, +120 s. The estimates agree exactly. 3 events are normalized by -120 s. Original times are preserved.
- **What the rule cannot tell us:** Whether the offset held outside the anchored moments, and whether each anchor pair really records the same moment.

**C-03**
- **Rule:** RULE-CLAIM-001
- **Type:** identity_not_established
- **Severity:** review
- **Evidence involved:** —
- **Explanation:** No source supports "The person in E-01 is the holder of badge B-117" (CL-04).
- **What the rule cannot tell us:** Who the person is. Appearance on camera does not establish identity.

## 05 Alternative hypotheses

**H-01**
- **Question:** Why does E-05 record a door event at 21:09:00?
- **Hypothesis:** The copied row is an import artifact
- **State:** inferred
- **Notes:** Field-for-field match with E-04 row 18 except time; import job log not available.

**H-02**
- **Question:** Why does E-05 record a door event at 21:09:00?
- **Hypothesis:** The copied row was edited after export
- **State:** unresolved
- **Notes:** E-05 has no edit history; this can be neither confirmed nor ruled out.

**H-03**
- **Question:** Why does E-05 record a door event at 21:09:00?
- **Hypothesis:** A genuine second door event at 21:09
- **State:** contradicted
- **Notes:** E-04 has no 21:09 row; E-01 shows no entry before 21:10.

## 06 Unresolved questions

**CL-04**
- **Statement:** The person in E-01 is the holder of badge B-117
- **State:** unresolved
- **Rationale:** No source links the person on camera to a badge.

**CL-06**
- **Statement:** EQ-4471 was on the trolley
- **State:** unresolved
- **Rationale:** The object on the trolley is obscured in E-02.

## 07 Methods and limitations

- Source times are never overwritten. Each event keeps the timestamp exactly as recorded next to its normalized time and the rule that produced it.
- Log files (CSV) are parsed deterministically; extraction for video, audio and PDF is simulated in this demo and is labelled as such.
- In this demo the E-02 clock offset is declared in the fixture metadata, not inferred from the evidence.
- Conflicts come from deterministic rules with stable IDs. A conflict is a prompt for human review, not proof of tampering.
- Every claim keeps its state (supported, contradicted, inferred or unresolved); the report does not drop uncertainty to make the timeline look cleaner.
- Hypotheses carry no probability score. The system compares evidence; it does not pick a winner.
- Results on a small synthetic case say nothing about accuracy on real investigations.

## 08 Appendix: Claims assessed

**CL-01**
- **Statement:** The loading-bay door opened at 21:12:00
- **State:** supported
- **Rationale:** Recorded directly in the access log; no cited source conflicts.
- **Citations:** E-04 (supports) · row 18

**CL-02**
- **Statement:** A trolley moved through the bay at 21:14:00
- **State:** supported
- **Rationale:** Recorded on E-02; time normalized for the 120 s clock offset inferred from two anchors.
- **Citations:** E-02 (supports) · timecode 00:39

**CL-03**
- **Statement:** The 21:16 alarm came from the loading-bay door
- **State:** inferred
- **Rationale:** The alarm audio does not name the door; the link relies on E-03 and E-04 together.
- **Citations:** E-03 (supports) · timecode 00:52; E-04 (supports) · row 18

**CL-04**
- **Statement:** The person in E-01 is the holder of badge B-117
- **State:** unresolved
- **Rationale:** No source links the person on camera to a badge.
- **Citations:** No citation

**CL-05**
- **Statement:** A separate door event happened at 21:09:00
- **State:** contradicted
- **Rationale:** Only the copied row in E-05 records it; the original access log and entrance camera conflict.
- **Citations:** E-05 (supports) · row 7; E-04 (contradicts) · rows 17-18; E-01 (contradicts) · timecode 00:14

**CL-06**
- **Statement:** EQ-4471 was on the trolley
- **State:** unresolved
- **Rationale:** The object on the trolley is obscured in E-02.
- **Citations:** No citation

## 09 Questions and findings

**Q-01**
- **Question:** In what order were the recorded events between 21:00 and 22:00?
- **Claims:** CL-01 (supported) The loading-bay door opened at 21:12:00; CL-02 (supported) A trolley moved through the bay at 21:14:00; CL-05 (contradicted) A separate door event happened at 21:09:00
- **Finding:** Not answered
- **Answer:** —
- **Cites:** —

**Q-02**
- **Question:** Did the 21:16 alarm come from the loading-bay door?
- **Claims:** CL-03 (inferred) The 21:16 alarm came from the loading-bay door
- **Finding:** Not answered
- **Answer:** —
- **Cites:** —

**Q-03**
- **Question:** Was EQ-4471 taken out on the trolley, and can the evidence say by whom?
- **Claims:** CL-04 (unresolved) The person in E-01 is the holder of badge B-117; CL-06 (unresolved) EQ-4471 was on the trolley
- **Finding:** Not answered
- **Answer:** —
- **Cites:** —

## 10 Sign-off

- **Status:** Not signed. This report is a working draft.