What evidence may show that a transfer completed?¶
The practical answer¶
Transfer completion should be established from evidence that the receiving system accepted the data or that the sending process finished successfully.
The key evidential caution¶
The dangerous assumption is that an upload request or outbound connection proves completion.
It may not.
Relevant evidence¶
Useful evidence may include:
Key points¶
- application success messages
- provider audit logs
- created destination objects
- matching file sizes or hashes
- server receipt logs
- completed transfer status
- recipient access
- network byte counts
- local deletion after successful upload
Investigators should compare source and destination records where possible.
A source may show that a transfer began.
The destination may show what was received.
A timeout, interruption or partial upload may leave different records on each side.
Evidential limits¶
Do not rely solely on traffic volume.
Compression, encryption, protocol overhead and retransmission can make byte counts difficult to interpret.
Likewise, a destination object may be incomplete or contain different content.
Where only one side is available, state the limitation and report whether completion is confirmed, supported or uncertain.
A successful status code or completed progress bar may still reflect only the sender’s view. Destination-side creation, matching size, hash or later access provides stronger confirmation. Where the receiving service performs deduplication or chunked upload, several technical events may represent one completed transfer.
For email or messaging, delivery status may establish acceptance by the provider rather than retrieval by the intended recipient. Keep provider delivery, account receipt and human access separate.
Operational takeaway¶
Use source and destination evidence together to establish whether the transfer completed, and distinguish full, partial, failed and unknown outcomes.