Case study • educational scenario
Two hours apart: examining a message timeline
An educational example of why a report and a screenshot may display different times.
The scenario
This is a fictional teaching example, not a client case or a claimed professional result. A screenshot shows 14:10; an application record shows 12:10. The timestamp format, device configuration and export settings have not yet been established. The discrepancy alone does not demonstrate manipulation.
A verification plan
Establish the origin of both records and preserve the available material with a record of the actions taken. Determine whether the field represents sending, receipt, synchronisation or modification. Check its unit, time zone and conversion rules. On a date when Poland uses UTC+02:00, 12:10 UTC corresponds to 14:10 local time. That is a hypothesis to test, not a universal explanation.
Keep the conclusion bounded
If the field format and export settings confirm the conversion, presentation may explain the discrepancy. This does not automatically establish the authenticity of the whole conversation or who wrote a message. Other surviving traces and comparisons can help. If only a screenshot remains, verification may be much more limited. The report should say which checks were not possible.
Methodological background
NIST SP 800-101 Rev. 1 covers preservation, acquisition, analysis and reporting of mobile data. Published in 2014, it is not a current tool capability list or a guarantee of access to a modern phone.
Sources and further reading
Educational material about Polish proceedings and digital forensics. Individual cases require examination of their records. Translations do not change the jurisdiction of the legislation discussed.
Discuss an expert assessment →