Standards · United States
OSAC Registry
NIST
Registry of published and proposed forensic standards. Verify individual document status before use.
Read original source ↗Forensic Knowledge Hub
A stronger question begins with a traceable source.
Explore selected primary resources for forensic research, evidence interpretation and responsible analysis.
Use this library to locate original guidance. Each source has its own scope, status and jurisdiction. Read the original document before applying it to a matter.
Editorial desk: review and publish →
5 resources
Standards · England and Wales
Forensic Science Regulator Code of Practice — version 2
Forensic Science Regulator
Quality framework for activities within its scope. Assess applicability to the particular activity.
Read original source ↗Interpretation · European guidance
Guideline for Evaluative Reporting in Forensic Science
ENFSI
Guidance on evaluative reporting. Read the original propositions, conditions and limitations.
Read original source ↗AI governance · Cross-sector guidance
Generative AI Profile — NIST AI 600-1
NIST
Voluntary guidance supporting evaluation of generative AI risks and controls.
Read original source ↗Publishing · Web publishing
Generative AI content guidance
Google Search Central
Guidance for accuracy, quality and added value when using generative AI content.
Read original source ↗Reviewed research notes
Mortgage fraud reconstruction: separate asset appreciation from loan repayment and refinancing
United Kingdom Supreme Court, criminal appeal from England and Wales concerning confiscation under the Proceeds of Crime Act 2002 as applied in 2012. Not a rule for other jurisdictions or a statement of the current law without checking later authorities and legislation. · Published 2026-11-08
Research run 2026-11-08 Europe/Amsterdam AUTOMATED research-note draft — A13 financial reconstruction. Prepared with AI assistance; pending human editorial review. One workflow performed research and checking roles, not sixty independently running agents or human peer review. QUEUE CHECK The connected status and fourteen records were read before drafting. None contained today's exact marker. Launch seeds were excluded from the quota; retracted records were included in the duplication check. All four specialisms have substantive coverage. A13 follows A12 in rotation. This note focuses on a financed property's change in value, refinancing and principal repayment rather than historical beneficial ownership or a general transaction reconciliation. SOURCE FACTS AND STATUS The official case page and full UK Supreme Court judgment were opened during this run. The court records judgment given on 14 November 2012, [2012] UKSC 51. The cited passage is from the majority, which addressed a fully secured loan obtained by fraud and subsequently repaid. Paragraph 35 distinguishes the repaid amount from appreciation attributable to the loan under stated conditions. Paragraphs 76–81 address case-specific treatment of a principal repayment and components of a remortgage; the majority substituted a confiscation order of £392,400. The separate opinion agreed with the central proportionality reasoning but disagreed with the majority's analysis of the benefit on these facts (paragraphs 82–86). Neither the fraction used in the case nor its treatment of the specific repayment is a universal formula. The source is an issued appellate judgment, not a draft or technical standard; this note is not a full current-law review. 365ALTERAM RESEARCH RECOMMENDATIONS Build a dated bridge from purchase price to valuation-date equity. Record the acquisition contribution by source, original mortgage advance, replacement finance, redemption of prior debt, fees, principal repayments and any funds released for other uses. Tie each entry to contemporaneous evidence, such as a completion statement, lender transaction history or redemption statement. Keep cash paid, principal outstanding and asset value in separate columns. Reconcile refinancing proceeds to uses, so the redemption of an earlier loan is not treated mechanically as an additional purchase contribution. Obtain valuations on the dates relevant to the competing calculations, with a documented basis and appropriate uncertainty. Show the change in net equity attributable arithmetically to changed valuation versus changed debt balance. Then present any disputed legal allocation under expressly stated instructions from counsel. A cost ledger can show expenditure on improvements; it cannot by itself establish the amount of market value those improvements added. Use sensitivity checks for disputed dates, outstanding balances, sources of repayments and valuation assumptions. CONTRARY EXPLANATIONS Greater equity could reflect general market appreciation, improvements, principal repayment from independent funds, or a combination. A larger replacement mortgage might substitute for prior debt, release cash for separate uses, or both. Test the competing accounts against dated lender records, cash flows and independent valuation evidence. Evidence that a loan enabled the acquisition can support one hypothesis; evidence that a particular increment came from a separately funded improvement or principal payment may qualify it. Neither full redemption nor rising asset value resolves the amount attributable to the conduct on its own. OUTPUT FOR HUMAN REVIEW Prepare a source-linked bridge with verified inputs, disputed inputs, alternative calculations and unresolved gaps. Leave legal characterisation and proportionality to jurisdiction-qualified counsel and the court. No client evidence was used. Retain for human editorial review.
Limitations: No property, loan file, bank statement, valuation or client evidence was examined. The proposed bridge is a 365Alteram review aid, not a court-prescribed or validated valuation model. The judgment is fact-specific, includes a separate opinion, and predates later legislation and authorities. No current legal test, causal allocation, benefit, recoverable amount, lender loss or case outcome is established. Pending human editorial review.
R v Waya (Appellant) [2012] UKSC 51 — UK Supreme Court judgment, 14 November 2012 ↗ · Paragraph 35, last clause of the final sentence, majority judgment. Read the full sentence for the qualifications concerning repayment, adequate security and absence of other property obtained. See also majority paragraphs 76–81 on principal repayment, refinancing and the order; compare the separate opinion at paragraphs 82–86.
Mobile data billing records: verify what the event time and cell fields describe
England and Wales statutory forensic Code for covered activities. Section 71 defines DIG 200 cell-site analysis for geolocation. The applicable version and scope depend on the forensic activity, where and when the work was performed, and the governing law. · Published 2026-11-08
Research run 2026-11-07 Europe/Amsterdam AUTOMATED research-note draft — A12 telecommunications. Prepared with AI assistance; pending human editorial review. One workflow performed research and checking roles, not sixty independently running agents or human peer review. QUEUE AND SOURCE CHECK The connected status and thirteen records were read first. None contained today's exact date marker. The four 27 October launch seeds were excluded from the quota, and retracted records were checked for overlap. All four specialisms have coverage; A12 follows A11 in rotation. This note addresses the meaning of fields in packet-data billing records, distinct from general method validation, historical survey comparability and phone-user attribution. The official accessible Code was opened during this run. Version 2 was published on 5 June 2025 and came into force on 2 October 2025 for England and Wales within its scope. An official-source search surfaced proposals for version 3 but no issued replacement. Section 99.10.12(a)(iv) identifies failure to recognise GPRS limitations as a normalisation risk. Section 99.4.2(c) flags data limitations when conclusions rely wholly or mainly on GPRS billing data; section 99.9.8(c)(iii) identifies different types of call-detail-record artefacts as relevant to practitioner training. The Code does not define the semantics of a specific operator's fields. 365ALTERAM RESEARCH RECOMMENDATIONS For each material row, preserve the original provider export and identify the network, record type, relevant dates, raw field names, values and identifiers. Ask for the provider's data dictionary or technical explanation for the relevant record type and period. Establish what generated the time field and what event the cell field describes. Do not assume that the two fields refer to the same instant merely because they appear in the same row. Also distinguish what the record can say about a device from any allegation that a person actively used it. Trace each reported event back to its source row. Record any transformation or field mapping introduced by normalisation. Where one interpretation requires the field to describe a connection at a specific time, identify the evidence that supports that interpretation and the time resolution it permits. Request independent contemporaneous corroboration where available; a map made from the same export is a derivative, not another observation. CONTRARY EXPLANATIONS Depending on the provider and record type, an apparent event may reflect a relevant network observation, a later session or billing trigger, or a reporting transformation. Background traffic may also explain a record without a deliberate user action. These are testable hypotheses, not generic descriptions of GPRS records. Compare the original schema, adjacent rows and documented operator behaviour. A well-defined event and corroborating records can strengthen the inference; if the event semantics remain unresolved, narrow the conclusion rather than assigning an exact time or a continuous route. OUTPUT FOR REVIEW Provide a row-level table linking the claim, raw fields, documented meaning, alternatives and unresolved limits. A qualified examiner should review material inferences. No client evidence was used. Retain for human editorial review.
Limitations: No operator specification, call-detail record, network, device or test data was examined. The proposed review is not a validated procedure and does not assume that record formats or field semantics transfer across networks or technologies. No particular event time, continuous route, precise location, user action, error rate, compliance finding or admissibility conclusion is established. Pending human editorial review.
Forensic Science Regulator, Forensic science activities: statutory code of practice, version 2 (© Crown copyright 2025; published 5 June 2025) ↗ · Section 99.10.12(a)(iv), full six-word item under CDR normalisation, accessible HTML. Read with section 99.4.2(c) on GPRS billing data limitations and section 99.9.8(c)(iii) on different types of CDR artefacts. Publication date and territory appear in the page header; commencement in the opening statutory statement.
Digital artifacts: verify what an application record means in the version that created it
United States NIST scientific foundation review, used for comparative forensic research. Not a mandatory forensic standard, domestic legal rule or admissibility decision. · Published 2026-11-06
Research run 2026-11-06 Europe/Amsterdam AUTOMATED research-note draft — A11 digital evidence. Prepared with AI assistance; pending human editorial review. One workflow performed research and checking roles, not sixty independently running agents or human peer review. QUEUE CHECK The connected status and twelve records were read first. No existing note contained today's exact marker. The four launch seeds were excluded from the automated quota, and retracted records were included in the topic check. All four specialisms have coverage. A11 follows A14 in rotation. This note examines how application versions and forensic parsers affect the meaning assigned to a record, rather than copy integrity, clock conversion or volatile-memory preservation. SOURCE FACTS AND STATUS The issued NIST report and its official publication record were opened during this run. The report is dated November 2022; NIST lists publication on 21 November 2022. This is the published scientific foundation review, not the earlier consultation draft or a certification of specific software. Section 4.6.3 puts artifact meaning in the context of the relevant operating system or application version. Section 4.7 identifies testing alternative explanations and noting contradictions as considerations in analysing results. The cited text does not establish how a particular product or release writes any specific field. 365ALTERAM RESEARCH RECOMMENDATIONS Start with the proposition in dispute. For example, if a report labels an item 'opened', identify whether the claim concerns a deliberate user action, an application state or merely a label assigned by an examiner's software. Trace the displayed label to the original source record, field and raw value. Record separately the likely application build when the record originated, any subsequent migration or upgrade, the build at acquisition, and the examiner's parser version and settings. Establish versions from contemporaneous traces where feasible; mark inferred or unknown versions as such. On a separate controlled system, ask a qualified examiner to compare known actions with the exact field and parser output. Where feasible, recreate the relevant version and configuration. Use a positive control that performs the alleged action and negative or alternative controls that omit it while allowing plausible background behaviour. Record pre- and post-test observations, reproduction steps and deviations from the original environment. If the relevant build cannot be replicated, treat a newer build as exploratory and state what cannot be transferred to the disputed record. CONTRARY EXPLANATIONS An application might create a similar entry through a deliberate action, a preview, automatic synchronisation, an import or a database migration. Alternatively, the original data might be unchanged while a parser uses a generic or incorrect label. These are hypotheses, not claims about any particular product. Compare original values and related records with controlled outputs. Where possible, verify the raw record through an independent method; two tools sharing a decoder may reproduce one assumption. Conversely, if only the alleged action reproduces the relevant pattern under the tested conditions and independent records also support it, report that support together with the limits of the controls. OUTPUT FOR REVIEW For each disputed label, report the original observation, version evidence, conditions tested, strongest competing explanation and remaining uncertainty. Distinguish a reproducible software event from attribution to a particular person or intent. No client evidence was used. Retain for human editorial review.
Limitations: No device, application build, database, parser or record was examined or tested. The suggested controls are a 365Alteram proposal, not a NIST-validated workflow. Results from another build, configuration or backend may not generalise. Reproduction shows what happened under test conditions; it does not identify a unique historical cause, a user, intent, an error rate or admissibility. Pending human editorial review.
NIST IR 8354 — Digital Investigation Techniques: A NIST Scientific Foundation Review (published 21 November 2022) ↗ · Section 4.6.3, Other Examples of Locating Possibly Relevant Artifacts, final sentence immediately before section 4.7, printed p. 39. Supporting context: section 4.7, printed p. 39, opening discussion of alternative hypotheses and contradictions.
Crypto evidence: reconcile off-chain Travel Rule messages with on-chain transfers
International FATF guidance on implementing AML/CFT standards for virtual assets and service providers. It is not domestic law or a rule of evidence. Applicable duties and lawful access depend on the jurisdiction, relevant date and type of transfer. · Published 2026-11-05
Research run 2026-11-05 Europe/Amsterdam AUTOMATED research-note draft — A14 crypto evidence. Prepared with AI assistance; pending human editorial review. One workflow performed research and checking roles, not sixty independently running agents or human peer review. QUEUE CHECK The connected status and eleven records were read before drafting. No record contained the exact date marker for today. The four launch seeds were excluded from the automated quota; retracted records were checked for overlap. All four specialisms have coverage. A14 follows A13 in rotation and has the oldest automated follow-up. This note examines the linkage between separately recorded messages and a transfer, rather than red-flag interpretation or blockchain confirmation status. SOURCE FACTS AND STATUS The official FATF PDF and publication page were opened. The cover dates the document October 2021 and the landing page dates publication to 28 October 2021. Paragraph 188 allows relevant information to travel separately from the ledger transfer and discusses timely, secure submission and availability to appropriate authorities. Paragraphs 182–183 distinguish what the sending and receiving institutions obtain and what they verify. The publication page expressly says the guidance does not reflect later revisions to FATF standards. FATF's separate 16 July 2026 implementation update was also opened and describes both progress and continuing gaps. This note uses the 2021 passage for the limited point about separate data channels; it does not infer current duties or any provider's compliance. 365ALTERAM RESEARCH RECOMMENDATIONS Reconcile three records where lawfully available: the on-chain transfer, the provider's internal withdrawal or deposit entry, and any associated Travel Rule message or message audit trail. Record the network, asset identifier, transaction hash and relevant output or event index, amounts and fees, source timestamps and time basis, internal references, and message identifiers. Preserve original records and identify where a match rests on a provider's direct cross-reference versus an analyst's inference. For a shared or batched transfer, test whether the provider ledger resolves the particular customer entry rather than relying on a transaction hash shared across several entries. Identify which data were supplied by a customer, passed through by another provider, or checked against independent records. A name in a message may corroborate an account association when the record is authenticated and the linkage is established. It does not by itself identify who operated a wallet, authorised the transfer or ultimately benefited. Keep those propositions separate and record what independent evidence each would require. CONTRARY EXPLANATIONS AND DISCRIMINATING CHECKS A missing name on the ledger may reflect ordinary separation of the channels. A missing message in a produced file may reflect limited export scope, retention or access limits, no counterparty provider, or non-transmission. A mismatched message may reflect the wrong chain, batch allocation, duplicate or amended messages, or an incorrect account association. Treat these as hypotheses. Test them against the provider's documented export scope, message lifecycle and internal transaction references; give equal attention to consistent records that support the linkage. Do not infer non-compliance merely from an incomplete production. Conversely, matching names, amounts or timestamps alone may not resolve a shared transaction or a copied data field. EDITORIAL DISPOSITION Prepare a table showing each proposed linkage, direct support, competing explanations and remaining gaps. A human editor must check the source and scope before publication. Any case application requires jurisdiction-specific advice on applicable duties and lawful access. No client evidence was used.
Limitations: No blockchain transaction, provider ledger, Travel Rule message or tool was tested. The October 2021 guidance predates later FATF revisions; it does not determine applicable current or historical domestic obligations. The proposed reconciliation is not a FATF-validated forensic method. A missing record does not establish breach, and a matched record does not establish private-key control, instruction, beneficial ownership, criminal provenance or admissibility. Pending human editorial review.
FATF, Updated Guidance for a Risk-Based Approach to Virtual Assets and Virtual Asset Service Providers (28 October 2021) ↗ · Section III, paragraph 188, first sentence (16 words), printed p. 60, PDF p. 62 (zero-based page 61). Context: paragraphs 182–183, printed p. 58, on information and verification roles; paragraphs 184–187, printed pp. 59–60, on submission; paragraph 190, printed p. 60, on availability to appropriate authorities.
Beneficial ownership: reconstruct who controlled the company on the transaction date
International FATF implementation guidance for Recommendation 24 on legal persons. Domestic definitions, registry effects and evidentiary rules depend on the relevant jurisdiction and date. · Published 2026-11-04
Research run 2026-11-04 Europe/Amsterdam AUTOMATED research-note draft — A13 financial reconstruction. Prepared with AI assistance; pending human editorial review. One workflow performed research and checking roles, not sixty independently running agents or human peer review. QUEUE CHECK The connected status and ten records were read before drafting. No existing record contained today's exact marker. The four 27 October launch seeds were excluded from the quota; retracted notes were included in the topic check. All four specialisms have coverage. A13 follows A12 in rotation and has the oldest automated follow-up. The new question is historical control of a legal person, distinct from the previous A13 note on movements of money and personal benefit. SOURCE FACTS AND STATUS The official FATF publication page, topic listing and March 2023 PDF were checked during this run. The landing page dates publication to 10 March 2023, and the topic listing continues to identify this edition as guidance for implementing Recommendation 24. It is issued international guidance, not domestic legislation or an evidentiary ruling. Paragraph 66 distinguishes verification of ownership, voting or control rights from checking whether rights are exercised in practice or under another party's instructions. Paragraph 67 explains that beneficial-owner status and the nature of control can change and that historical information can be useful. Paragraph 71 discusses updating records after changes. These provisions do not establish control of any specific company or transaction. 365ALTERAM RESEARCH RECOMMENDATIONS Define the disputed entity by jurisdiction and company identifier and fix the relevant transaction date. Build a control chronology with separate columns for the claimed effective date, evidence creation date, filing or acceptance date and date of retrieval. Preserve earlier registry extracts and any correction history where lawfully available. Record separately who held legal title, who held voting or appointment rights, who appears to have exercised control and who actually instructed the transfer. A person may feature in one column without featuring in the others. Test each material change with appropriately dated evidence, such as executed share transfer instruments, relevant shareholder agreements and amendments, voting proxies, corporate minutes or evidence of how voting and appointment rights were used. Seek independent corroboration of disputed dates where feasible. A later registry extract and a compliance file copied from it are two documents but may reflect one underlying declaration. A bank mandate may help test who could instruct payment; it does not by itself establish beneficial ownership or prove who gave the instruction. CONTRARY EXPLANATIONS A mismatch between records could reflect ordinary filing delay, a later correction, conditional completion, a mistaken entity match, or control exercised by someone other than the person named. A discrepancy is a lead; a dated sequence and corroborating evidence are needed to distinguish these explanations. Test evidence favouring continuity as carefully as evidence of change: a new director, signatory or address may leave ultimate control intact. Equally, stable legal title need not resolve a change in voting rights or effective control. When evidence is missing, state which interval or proposition remains unresolved rather than assigning a definitive controller. OUTPUT FOR HUMAN REVIEW Prepare a dated table of asserted control, documentary support, conflicts and gaps, with the status of each proposition stated as supported, disputed or unresolved. Ask jurisdiction-qualified counsel to identify the applicable legal test before mapping those findings to legal conclusions. No client evidence was used. Retain for human editorial review.
Limitations: No company, registry file, agreement, transaction or client record was examined. The timeline is a proposed 365Alteram review aid, not a FATF-validated forensic method. Filing dates, legal effect, record access and evidentiary weight vary by jurisdiction. No beneficial owner, transaction instruction, criminal intent, proceeds, loss or admissibility is established. Pending human editorial review.
FATF, Guidance on Beneficial Ownership of Legal Persons (March 2023; published 10 March 2023) ↗ · Section 7, Verification of Status of the Beneficial Owner, paragraph 67, first sentence, 17-word excerpt after 'As'; printed page 25. See paragraph 66(i)–(ii), same page, and section 8, paragraph 71, printed page 27.
Phone-user attribution: test conflicting call data before linking a device to a suspect
England and Wales statutory forensic Code, within its defined activity, territorial and temporal scope. Comparative use elsewhere requires separate assessment. Not an automatic admissibility rule or a finding about any person. · Published 2026-11-03
Research run 2026-11-03 Europe/Amsterdam AUTOMATED research-note draft — A12 telecommunications. Prepared with AI assistance; pending human editorial review. One workflow performed research and checking roles, not sixty independently running agents or human peer review. QUEUE AND QUOTA CHECK The connected status and all nine returned records were read before drafting. None contained today's exact Research run date marker. The four 27 October launch seeds do not consume the automated quota. Retracted records were included in the topic check. Each rotating specialism already has substantive coverage, so none is wholly uncovered. Following yesterday's A11 note, A12 receives a distinct follow-up on user attribution, rather than repeating method validation or historical survey comparability. The separate autonomous runtime reports blocked_usage_limit; this connected workflow is performing the present research and submission. SOURCE FACTS AND DOCUMENT CHECK The official accessible Code and its publication landing page were opened during this run. Version 2 was published on 5 June 2025 and came into force on 2 October 2025. A current official-source search identified development of version 3, but no issued replacement was identified. Availability is not proof that every related requirement is unchanged; editors should recheck status before case application. Section 99.9.7(b) includes evaluating whether call data fit the proposition that a suspect used a device and whether data conflict with it. Section 99.9.8 addresses proposition testing, transposed conditionals and cognitive bias. Section 99.9.11 addresses competence for opinions. These provisions support scrutiny of attribution reasoning; they do not establish the identity of any actual user. 365ALTERAM RESEARCH RECOMMENDATIONS — PROPOSED CONTROLS Define the disputed proposition by person, device or subscription identifier, and relevant period. Keep account registration, possession and use at a particular event as separate questions. For each alleged linkage, document the observation, original source, reasoning and uncertainty. An assertion that a number is associated with someone should not silently become a finding that this person performed every recorded activity. Prepare an attribution register with columns for the claimed user, interval, identifiers, supporting observations, conflicting observations and unresolved assumptions. Ask a qualified examiner to explain any conversion between identifiers and whether it is supported for the relevant interval. Preserve original records alongside derived tables. CONTRARY EXPLANATIONS AND DISCRIMINATING CHECKS Consider shared access, temporary borrowing, changed possession and mistaken identifier linkage as hypotheses requiring evidence, not established explanations. Ask what lawfully available contemporaneous material could distinguish these from continuous use by the alleged user. Check whether apparently independent corroboration actually repeats the same initial attribution assumption. Give equally serious attention to material strengthening attribution: documented exclusive access, consistent identifiers or independently established contemporaneous use, where available. Conversely, a single apparently inconsistent record might reflect a data-processing mistake rather than a different user. Verify its provenance and interpretation before treating it as decisive. Ask whether the conclusion concerns consistency with a proposition or a probability that the proposition is true. Do not invent numerical confidence from a pattern match or infer criminal knowledge from device association. Where alternatives cannot be discriminated, identify the unresolved issue explicitly. EDITORIAL DISPOSITION Propose a concise assessment identifying the strongest support, strongest conflict, dependencies and further checks for each material interval. These controls are 365Alteram research proposals, not a validated attribution method prescribed by the Code. Human editorial assessment of the source and reasoning remains pending. No client evidence was accessed, and no approval, publication, external message or API-key creation was performed. The separate daily blog task is unchanged.
Limitations: No CDRs, subscriber records, device, identifiers or attribution software were examined or tested. The Code is a quality framework, not a case-specific attribution study; the proposed register is not a validated method. No error rate, numerical probability, identity, intent, criminal participation, admissibility or outcome is established. Suggested alternative explanations are hypotheses only. Applicable Code version, activity scope and local law require qualified assessment. AI-assisted draft pending human editorial review.
Forensic Science Regulator, Forensic science activities: statutory code of practice — version 2 (published 5 June 2025; effective 2 October 2025) ↗ · Section 99.9.7(b), opening 17-word excerpt; read the remainder of the same clause concerning conflicting data. Supporting context: 99.9.8(b)(i)–(ii) and (d) on propositions, transposed conditionals and cognitive bias; 99.9.11 on competence to express opinions; Glossary, 'Attribution (digital)'. Document commencement: opening statutory statement; scope: 1.4.4–1.4.6 and 100.3.5–100.3.6. Accessible HTML, no PDF pagination.
Mobile evidence timelines: verify clock settings before drawing conclusions
United States technical guidance, used here for comparative research. Voluntary use by nongovernmental organisations; not a jurisdiction-specific admissibility rule or legal opinion. · Published 2026-10-28
Manual additional research concept requested by Erwin Jager on 28 October 2026, Europe/Amsterdam. Prepared with AI assistance; pending human editorial review. This additional manual concept is separate from the automated A13 research note delivered earlier today. SOURCE FINDINGS The official NIST publication page and final PDF were opened. The publication is dated May 2014. Section 5.3 explains that a device clock may reflect network settings or manual input, and that an inaccurate setting can affect the apparent times in call and message records. It recommends documenting differences from a reference clock. This supports checking clock provenance; it does not prove any discrepancy in a particular exhibit. 365ALTERAM PROPOSED RESEARCH PROTOCOL — NOT A VALIDATED NIST PROCEDURE Before combining records, create a timestamp register. For each material event record the source exhibit, original value, field name, stated or unknown time basis, relevant software version, conversion applied and remaining uncertainty. Preserve raw values alongside any normalised display. Treat a device clock observation as one observation at one moment; do not assume it establishes a constant historical offset. Ask the examiner to explain whether a field represents creation, receipt, server processing, synchronisation or export. These are questions for source-specific examination, not assumptions about every application. Identify any transformations made by extraction software, spreadsheets and report-generation tools. Retain the settings and calculations necessary to reproduce each conversion. ALTERNATIVE EXPLANATIONS TO TEST If two records differ, test the possibility of a time-zone conversion, daylight-saving transition, device clock change, synchronisation delay or different event definitions. Also test whether the apparent match between two times results from a shared conversion error. None of these possibilities establishes that an error occurred; each requires support from the relevant records and technical documentation. Use lawfully available independent records where suitable. Ask whether a transaction receipt, provider record or other contemporaneous observation identifies the same event and has a known time basis. Independence must be assessed: two exports derived from the same database do not automatically provide two corroborating observations. PRACTICAL OUTPUT FOR COUNSEL Prepare a table of critical events showing the original time, interpretation, transformation, corroboration and unresolved questions. Where uncertainty matters, present a justified interval or state that timing cannot yet be resolved. Explain whether the disputed sequence survives the plausible alternatives. Refer legal significance to jurisdiction-qualified counsel; do not infer knowledge, participation or intent from timing alone. EDITORIAL DISPOSITION Retain as draft until a human editor verifies the supporting passage, the distinction between source findings and proposed controls, and the scope of the limitations. No client material has been examined. No independent human peer review has been performed.
Limitations: Historical May 2014 guidance; no claim that its operational instructions describe current devices, applications or extraction products. The source supports scrutiny of device clock settings, not the entire proposed review protocol. No device, dataset, tool or conversion was tested. No error rate, attribution, case outcome, admissibility or sentence reduction is established. Clock provenance and field meanings require current source-specific technical verification. Pending human editorial review.
NIST SP 800-101 Rev. 1 — Guidelines on Mobile Device Forensics (May 2014) ↗ · Section 5.3, Mobile Device Memory Acquisition, printed page 41 / PDF page 51: paragraph beginning 'The date and time maintained on the mobile device'. Supporting preservation discussion: section 4.3, printed page 30 / PDF page 40.