Why can one artefact show several different times?¶

One item can pass through creation, transmission, modification, storage, synchronisation and display, with a different system timing each stage.

Reconstruct the lifecycle¶

A message may carry draft, server, delivery, read and edit times. A photograph may carry capture, file creation, import, upload and later download times. Database-file modification or backup time can describe the container rather than the individual record. Label every value by source and event.

Explain differences before treating them as error¶

UTC, local device time, fixed offsets and viewer conversion can coexist. A later handset file time may correctly describe download of an older image. Where order remains impossible, test clock error, timezone, parser field meaning, inherited metadata and recovered state. The earliest value is not automatically original.