EVIDENCE RECONSTRUCTION
Restore traceability. Preserve the gaps.
Operational activity may have generated logs, tickets, tests and approvals without leaving a coherent record of control operation or decision history. Reconstruction locates and binds what already exists.
EVIDENCE CONTINUITY
Absence is not converted into evidence.
WHEN IT APPLIES
The record is fragmented, not necessarily absent.
A system may have relevant evidence scattered across teams and tools. The work is to establish whether those fragments can be linked to a particular claim, state, time and criterion.
THE METHOD
Locate. Bind. Check. Record gaps.
The sequence preserves both the usable record and the limits of reconstruction.
Locate
Identify relevant operational artifacts.
Bind
Connect each artifact to system state, owner, time and control.
Check
Verify basis, integrity and relevance against defined criteria.
Record gaps
Keep stale, contradictory and unavailable material explicit.
OUTPUT BOUNDARY
An inferred link remains an inference.
Reconstruction cannot manufacture an event, claim that an unverified record was checked, or use the absence of a log as proof that an event did not occur. The final record states where traceability stops.
NEXT STEP
Bring a fragmented evidence chain.
Describe the claim to be examined and the systems or repositories where records may be held.