Most matters turn on sequence: what was known, done or sent, and when. No single device holds that story. A defensible timeline is built by correlating artefacts across sources — handset, laptop, cloud accounts, building access logs — and being rigorous about the one thing that undoes timelines: time itself.
Normalise Before You Correlate
Devices record in a mix of UTC, local time and application-specific epochs; Australian matters add daylight saving and cross-jurisdiction offsets (an event logged 09:00 AEST is 08:30 in Adelaide and 07:00 in Perth). Every artefact is converted to a single reference timezone, with clock drift measured against known events — a sent email whose server timestamp is trusted, a CCTV frame — before any sequencing is asserted.
Corroborate Across Independent Sources
A message's handset timestamp is one witness; the telco record, the recipient's device and the platform's server data are others. Where independent sources agree, the event is solid. Where they disagree, the disagreement is itself a finding — often evidence of clock manipulation or backdating. The same logic joins file activity to human activity: a document's last-modified time gains meaning when it sits between a screen unlock and a USB connection event.
The deliverable is a court-ready chronology in which every entry cites its source artefacts, its confidence, and its assumptions — so counsel can put a sequence to a witness knowing exactly how firmly each link holds.
Worked Example: One Morning, Three Sources
An illustration of how the method plays out. In a fraud prosecution the question is often whether a document existed when the accused says it did. No single device answers it — the handset goes quiet for twenty minutes, and it's the laptop's event log and the cloud server that say what happened in the gap.
Illustrative scenario. All times normalised to AEST; each source's clock offset measured before sequencing.
How This Appears in the Report
The chronology is annexed to the expert report as a table, and every entry carries three things: the artefacts it rests on (by exhibit reference), whether it is corroborated by an independent source, and any assumption it depends on. The row that matters most in this example — the one that shows the document could not have existed in 2023:
Gaps are reported as gaps — stating what the sources cannot say is part of what makes the chronology defensible, and it is what the other side's expert will look for first.
Frequently Asked Questions
Why Do Timestamps Differ Between Devices?
Devices record in a mix of UTC, local time and application-specific epochs, and Australian matters add daylight saving and cross-jurisdiction offsets — an event logged 09:00 AEST is 08:30 in Adelaide and 07:00 in Perth. Device clocks also drift. Every artefact must be normalised to one reference timezone before any sequence is asserted.
Can Device Timestamps Be Manipulated?
Yes — which is why a defensible timeline corroborates each event across independent sources: the handset, the telco record, the recipient's device, the platform's server data. Where independent sources disagree, the disagreement is itself a finding, often pointing to clock manipulation or backdating.
What Does a Court-Ready Chronology Contain?
Every entry cites its source artefacts, its confidence level and its assumptions — so counsel can put a sequence to a witness knowing exactly how firmly each link holds.