Evidence viewer
Verify source context, inspect extraction locators, and keep integrity metadata visible.
Source viewer · E-02
880f3338e8c9d68757e924c42b1b1fb9.jpg · 880f3338e8c9d68757e924c42b1b1fb9.jpg
Linked events
Events extracted from this source with precise locators.
No events from this source fall inside the incident window.
Source clock · E-02
Now: Reference clock · no offset. Original times never change; only normalized time is re-worked.