Operational sequence
- Capture original bytes and metadata.
- Use UTC timestamps.
- Record every custody transfer.
- Separate source integrity from claim truth.
- Never overwrite conflict; preserve both candidates.
Failure states
- Silent merge
- Unlogged redaction
- Treating a copied screenshot as the only source
- Allowing the investigator to rewrite the evidence