Why might one conversation appear in several places?¶

One communication can create records in an active database, notification store, index, cache, journal, backup, attachment store and participant device.

Match traces to the event¶

Compare message and conversation IDs, account, participants, direction, time, attachment and source path. A preview may be truncated, a journal may preserve an edit and a recovered row may lose context. Different acquisitions or cloud/backup sources can add further versions.

Group without overstating corroboration¶

Several parser views of one row are duplicates, not independent confirmation. A notification and active record are different traces of the same event; a recipient copy can be independent. Choose the richest primary artefact and retain other sources when they add state, timing, history or provenance.