Technical Evidence

Technical work depends on evidence that is identifiable, usable, sufficiently complete, and appropriate to the accepted scope.

Evidence identification

Identify the source, file or system, collection period, relevant channels or fields, version where applicable, and any known transformations.

Time and synchronization

Where event timing matters, identify timestamps, time basis, synchronization method, clock quality, and known offsets or gaps.

Integrity

Preserve original evidence where practical. Record replacements, transformations, validation steps, and material differences between versions.

Missing or conflicting information

Missing, corrupted, conflicting, or unexplained information may limit or prevent a technical conclusion. DEOB should not manufacture assumptions to fill evidence gaps.

Evidence disposition

Evidence may be accepted, conditionally accepted, rejected, or retained for clarification depending on its suitability for the defined scope.