Ingest source material, preserve originals, and track validation and extraction separately.
Evidence register
Source time is immutable; normalized time belongs to the extracted event.
| ID | Source | Type | SHA-256 / provenance | Status |
|---|
| E-01 | Screenshot_20261011_071630_com_whatsapp_StatusPlaybackActivity.jpg | IMAGE | 1010…2c1a | Queued · stored, not extracted |
| E-02 | 880f3338e8c9d68757e924c42b1b1fb9.jpg | IMAGE | 0891…eec7 | Queued · stored, not extracted |