How should uncertainty about the original state be reported?¶

Separate what was directly observed, what another person reported and what remains unknown. A transparent limitation is stronger than a confident reconstruction unsupported by evidence.

Identify how the state may have changed¶

Record known or possible prior actions such as moving, charging, unlocking, disconnecting, restarting, forwarding, screenshotting and changing account security. Note unknown power or network state, missing cables, changed displays and incomplete account history. Do not call an item “untouched” without a basis.

Where sequence or time cannot be fixed, use an evidenced range or state that order is unresolved. Preserve conflicting accounts rather than merging them into one narrative.

Explain the consequence of the gap¶

State why uncertainty exists, whether it arose before arrival, during preservation or in later handling, and how it may affect chronology, attribution, completeness or interpretation. Photographs, logs and witnesses may resolve part of the issue; record both what they establish and what remains open.

A specialist assessment can be proposed where technical artefacts may clarify change, but not promised as a certain answer. Plain description of the limitation lets others evaluate the evidence without technical language concealing the gap.