Typical scenarios within this site’s subject: questions to ask, materials to prepare and points that can be examined.
Typical scenarios
If a document in a ZIP appears to predate the archive’s dispatch, someone may treat this as evidence of backdating. In this hypothetical situation, dates displayed by the archiver and the extracted file’s properties are compared across different time zones without checking which fields represent creation or modification.
Typical scenarios
Dividing frame count by a displayed rate depends on recording and export behaviour. Review a transcoded clip’s timestamps, variable intervals and repeated frames, preserving the original and distinguishing export settings from source properties.
Typical scenarios
A USB connection record may be linked to document removal without examining files. Investigate the specified folder and device to separate connection, opening and copying, preserving original digital data and a verifiable acquisition trail.
Typical scenarios
Missing local files do not by themselves explain why a synced folder changed. A typical examination tests cloud-account deletion, selective sync settings and local actions against the surviving device records.
Typical scenarios
If a familiar action produces a different amount, the reason may be changed inputs, an algorithm or requirements. Comparing two screenshots without version information does not yet identify the explanation.
Typical scenarios
If an email is available only inside a forward or screenshot, the original message must be distinguished from its display. The sender name and shown date do not replace technical headers. Forwarded text may contain additions made by software or a user.
