# Investigation report · CASE-002

_Generated 2026-10-25T11:47:15.683436Z · model 1.0_

> Investigative aid only. This report does not determine responsibility or guilt. All data is fictional.

## 01 Scope and case context

- **Case:** CASE-002 · Team check — persistence
- **Summary:** Team test that cases survive a redeploy. Safe to ignore.
- **Incident window:** 2026-10-10 06:00:00 – 07:30:00 site time (UTC+01:00)
- **Status:** open
- **Data:** Live case

## 02 Evidence inventory

| ID | Item | Type | SHA-256 | Ingested at |
| --- | --- | --- | --- | --- |
| — | — | — | — | — |

## 03 Reconstructed timeline

| Event | Source time → Normalized time | Rule applied | Claim state | Source locator |
| --- | --- | --- | --- | --- |
| — | — | — | — | — |

## 04 Conflicts and rules

_None._

## 05 Alternative hypotheses

_None._

## 06 Unresolved questions

_None._

## 07 Methods and limitations

- Source times are never overwritten. Each event keeps the timestamp exactly as recorded next to its normalized time and the rule that produced it.
- Log files (CSV) are parsed deterministically; extraction for video, audio and PDF is simulated in this demo and is labelled as such.
- In this demo the E-02 clock offset is declared in the fixture metadata, not inferred from the evidence.
- Conflicts come from deterministic rules with stable IDs. A conflict is a prompt for human review, not proof of tampering.
- Every claim keeps its state (supported, contradicted, inferred or unresolved); the report does not drop uncertainty to make the timeline look cleaner.
- Hypotheses carry no probability score. The system compares evidence; it does not pick a winner.
- Results on a small synthetic case say nothing about accuracy on real investigations.

## 08 Appendix: Claims assessed

_None._

## 09 Questions and findings

_None._

## 10 Sign-off

- **Status:** Not signed. This report is a working draft.