What needs to be clarified
The task could compare time fields and processing traces and assess whether the sequence of versions can be reconstructed. The time of the event should be distinguished from the creation time of a particular file copy.
Materials to prepare
- Files in their original format without resaving, preferably with adjacent frames.
- Information about the device, clock settings and transfer method for each file.
- Correspondence, exports or other records against which receipt of an image can be checked.
What to compare
- What each time field means, its time zone and consistency with other values.
- Dimensions, structure, metadata and export traces in the compared versions.
- How technical timestamps relate to independent transfer records and frame sequence.
Possible outcome of the analysis
A possible output is a version table explaining timestamps and the sequence of transformations that the evidence supports. Unsupported values would be identified separately, rather than treated as independent proof of capture time.
Limits of the conclusions
Metadata can be changed or absent. Without independent corroboration, examination cannot guarantee the exact event date, location or authorship; a copy’s creation date is not automatically the date of the depicted event.