How do I record where an artefact came from?¶

Create a finding reference that connects the understandable artefact back to the device, extraction, report and technical source.

Record the evidence layers¶

Identify the case and exhibit, handset/SIM/backup/cloud source, acquisition or package, report tool and version, and relevant filters or time-zone setting. For the artefact, capture application and account, participants, state, displayed time, message or event ID, source path and whether it was active, deleted, recovered or parsed.

Make discovery reproducible¶

For media, retain file name, hash where available and its attachment, cache or thumbnail relationship. Record the search term, filters, timeline view or examiner bookmark that located it. Pair the technical path with an ordinary-language explanation so both an investigator and examiner can follow the chain.