Digital Evidence Models

Investigation Event Record

Digital investigation events can be represented as actor, device, account, source, and review records. Honesty note: simplified US federal classroom model; Fourth Amendment doctrine and state rules vary; the pinned first step states the as-of date; not legal advice.

Structured Visual

Jurisdiction: US; as of 2026-06-24; not legal advice; Code encodes a process and label model, not the law itself.

RENDER STRUCTURE · REFUSE INTERPRETATION · CITE · ABSTAIN · HAND-OFF: render structure, refuse interpretation, cite provenance, abstain when unsupported, and hand off to human review.

Simplified digital investigation event recordsrowfieldvaluequerytokensactor,device,account,event,source,reviewquerycount6supportcount2supportabstainFalsescopejurisdictionUS federal classroom modelscopesource_typeinvestigation_eventrecord device_eventrank1record device_eventmatch6 of 6record device_eventfilterpassrecord device_eventciteToy Digital Event 1record device_eventsnippetActor device account event source provenance human review status label.record account_eventrank2record account_eventmatch5 of 6record account_eventfilterpassrecord account_eventciteToy Digital Event 2record account_eventsnippetActor account event source provenance human review status label.
highlighted = computed this step

Digital evidence model honesty note

Honesty note: simplified US federal classroom model; Fourth Amendment doctrine and state rules vary; as of June 24, 2026; not legal advice; code encodes a process and label model, not the law itself.

digital evidence model as of June24,2026\text{digital evidence model as of }June 24, 2026

Start with an event record

The stated process stores a digital investigation event as actor label, device or account label, event date, source, and review-status fields.

event record before review\text{event record before review}

Example event packet

The toy event date is May 12, 2026. The classroom log includes a device-event row and an account-event row.

event date=May12,2026\text{event date}=May 12, 2026

The table recomputes support

The retrieval table recomputes 2 records and 2 token-supported rows from the authored event text.

records=2,support=2\text{records}=2,\quad \text{support}=2

Diagram note

The diagram is an investigation-event table. It is provenance and review data, not a criminal-procedure conclusion.

event table only\text{event table only}

Jurisdiction: US; as of 2026-06-24; not legal advice; Code encodes a process and label model, not the law itself.

RENDER STRUCTURE · REFUSE INTERPRETATION · CITE · ABSTAIN · HAND-OFF: render structure, refuse interpretation, cite provenance, abstain when unsupported, and hand off to human review.

Simplified digital investigation event recordsrowfieldvaluequerytokensactor,device,account,event,source,reviewquerycount6supportcount2supportabstainFalsescopejurisdictionUS federal classroom modelscopesource_typeinvestigation_eventrecord device_eventrank1record device_eventmatch6 of 6record device_eventfilterpassrecord device_eventciteToy Digital Event 1record device_eventsnippetActor device account event source provenance human review status label.record account_eventrank2record account_eventmatch5 of 6record account_eventfilterpassrecord account_eventciteToy Digital Event 2record account_eventsnippetActor account event source provenance human review status label.

Summary

Digital evidence workflows should expose actor, device, account, date, source, and review fields before any gate trace.

fields before trace\text{fields before trace}