Investigative aid only. This report does not determine responsibility or guilt. All data is fictional.
01 Scope & case context
CASE-003 · Missing earpod.
Incident window 08:30–14:30 site time (UTC+01:00), 2026-10-16.
02 Source inventory
| ID | Source | Type | Integrity |
|---|---|---|---|
| E-01 | Screenshot_20261011_071630_com_whatsapp_StatusPlaybackActivity.jpg | image | SHA-256 1010c700ee16… |
| E-02 | 880f3338e8c9d68757e924c42b1b1fb9.jpg | image | SHA-256 08911d0c7e5c… |
03 Reconstructed timeline
| Normalized | Source time | Event | Citation | State |
|---|
04 Conflicts & rules
05 Alternative hypotheses
06 Unresolved questions
07 Methods & limitations
- Log files (CSV) are parsed deterministically; video, audio and PDF extraction is simulated from seed metadata in this demo.
- Source times are never overwritten. Normalized times are derived and carry the rule that produced them.
- The E-02 clock offset is inferred from two anchor moments it shares with reference-clock sources (RULE-TIME-002). The anchor events themselves are simulated from seed metadata.
- Conflicts come from deterministic rules with stable IDs. A conflict is a prompt for review, not proof of tampering.
- Results on a small synthetic case say nothing about accuracy on real investigations.