Why should investigators request raw records rather than only a provider summary?¶

A provider may supply a short narrative describing what its systems show.

Evidential caution: that the summary contains every relevant detail and can be interpreted without the underlying records.

What this means¶

A summary may omit event IDs, device identifiers, status changes, field values, time zones, failed events and technical qualifiers.

It may also combine several records into one sentence or use provider terminology without explaining it.

Raw records can preserve the original fields, sequence, identifiers and timestamps needed for review.

They allow investigators and specialists to test how the conclusion was reached, compare records across systems and identify inconsistencies.

Request field definitions, time-zone information, code explanations and any data dictionary needed to interpret the return.

Where a summary is the only available return, record that limitation and avoid overstating what was independently verified.

In reports, distinguish the provider’s interpretation from conclusions drawn from the underlying records.

Where the scope is disputed, record why each requested field is relevant to the investigative question.

What to check or do next¶

• Preserve the provider’s original format and any covering explanation. Do not convert the data into a spreadsheet or timeline without retaining the source.
• Preserve the source and collection method so another investigator can test the same interpretation.
• Preserve the source and collection method so another investigator can test the same interpretation.

Evidential limits¶

Raw does not mean automatically complete or self-explanatory. The provider may still apply retention limits, redactions or system boundaries.