How do you state timeline ordering confidence to counsel when timestamps come from different clocks?

## Who is actually reading An eleven-week exfiltration through a sanctioned file-sync client ends up in front of privacy counsel and an HR reader. They do not want a discussion of MFT records. They ask two questions: **which of these two things happened first**, and **how sure are you** — and the answer will contribute to a decision about a named employee. That audience is exactly why the confidence language has to be built into the finding rather than added as a caveat at the end, where it gets dropped in the summary. ## Three registers, kept apart **1. What was recorded.** The raw value, the source that produced it, and the reference it was stated in. This is fact and is written as fact. **2. What ordering that supports.** This is the part that needs a bound. Two events recorded by the **same clock** are ordered as reliably as that clock's resolution allows — no offset enters the comparison, and even a clock that is wrong by an hour still orders its own events correctly. Two events from **different clocks** are a different animal: the comparison is only as good as your bound on the offset between them. So the honest form of the claim is *gap versus uncertainty*: - Events 41 minutes apart, on two sources each anchored to within about 90 seconds: the order holds comfortably, and you can say so. - Events 90 seconds apart, one from a source whose offset you derived from an anchor and one from a source you could not anchor at all: **you cannot order them**, and the right sentence is that the evidence does not establish which came first. **3. What that says about a person.** File-system and application records evidence operations carried out by a process under an account. A session record can put a credential in use on the host; none of it proves who was at the keyboard. Counsel is entitled to know that boundary before relying on the report, and telling them late is worse than telling them at all. ## Say what would resolve it An unresolvable ordering is more useful when it comes with the thing that would settle it: a source with finer resolution covering the same window, a record from a system whose clock you can anchor, or a causal dependency — an object cannot be uploaded before it exists on the volume — that fixes the sequence independently of any clock. Sometimes that dependency is the whole answer and no offset work is needed; recognising when logic beats arithmetic is the senior move here. ## The pressure to compress, and how to hold The request will come: *just give us the start date*. The eight-week correction that came out of normalising the sources is precisely why a single date is the wrong deliverable — the first number the case ran on was wrong, and it was wrong in the direction of understating the exposure. Offer two dates with different standing: - **Earliest defensible activity**: the earliest event the evidence supports, with the sources that support it. - **First independently corroborated event**: the earliest point where two sources agree, which is what will survive challenge. And give the uncertainty a *direction* where you can. "The true start is at or before this date" is far more useful to counsel than a bare range, because it tells them which way the risk points if they act on it. ## Write it to be re-derived, not believed Every ordering claim should be traceable to the row that supports it: original value, source, reference stated, offset applied, how the offset was derived, resulting UTC value. That is not bureaucracy — it is what allows a second examiner, possibly one retained by the other side, to reproduce your work and get the same answer. A conclusion that can only be accepted on the author's authority is a weak conclusion regardless of how carefully it was reached. ## Own the standard, not just the case The principal-level responsibility is not this one report, it is the house rule: findings are written in the three registers; every quoted time is UTC with its origin recorded; unresolvable orderings are stated as unresolvable rather than filled in with the plausible one; and no examiner is asked to convert an interval into a single date because a template has one field for it. The cost of that discipline is a slightly less satisfying document. The cost of skipping it is a finding about a named person that falls apart the first time somebody competent reads it back — which is the outcome that damages both the case and the team's standing to be believed next time.