<a id="week-05-day-01"></a>

#### Day 21 — Version a timeline around event time and knowledge time

**Theory and mechanism.** A timeline is a derived argument: it selects records, transforms time representations and states why entries matter. Its event ordering and its knowledge ordering answer different questions. Event time asks when the producer says something occurred; knowledge/receipt time asks when the analyst could use the supplied record. Retain source event, ingestion where known, case receipt/release, transformation and claim limit. A new version may incorporate later evidence, but the earlier decision must remain reconstructible. The [NIST forensic-techniques guide](https://csrc.nist.gov/pubs/sp/800/86/final) supplies acquisition/analysis context; this versioned classroom table is an original teaching method.

**Worked contrast.** At 09:22, the investigator can record C05's reported 09:01 edit but cannot cite `batch-17`. C12 adds that tag at 09:26 as a read-only view of the **same reported application request**. Recording a second edit at 09:26 would confuse a new observation about an old event with a new source event. Conversely, backfilling the tag into the frozen 09:22 assessment would pretend the analyst knew it earlier. Use a supplement pointing to C05 and C12, not a rewritten raw C05 record.

C11 requires another distinction: 09:24 is when support provides the statement. The alleged addendum's existence, effective time and contents remain unspecified. A timeline row cannot use 09:24 as the approval time of an unprovided document. Preserve the quotation's uncertainty—“might have been included”—rather than changing it to “included.” C06's visible S40/S41 approval and C11's possible S42 addendum are separate records in tension, not an approval history the analyst is free to complete.

| New timeline information | Underlying event/claim time | Case knowledge time | Defensible annotation |
|---|---|---|---|
| C11 operator statement | Time of a purported addendum not supplied | 09:24 | Lead for change-authority verification; no addendum received |
| C12 application view | Supplements C05's 09:01 request `q-144` | 09:26 | Self-reported tag observed in supplied view; no validated scheduler origin |

**Assumptions and decision.** Keep earlier uncertainty intact. C02's symptom was noticed *around* 09:00; C05 records an edit at 09:01. Do not move either time to make the edit appear causal. The apparent order may motivate questions about reporter precision, clocks, caching or an earlier event, but none is an observed explanation. A sorted table is not a causal test. Likewise C04's corrected 08:58 estimate and C10's conditional 09:21 conversion retain their distinct time-basis limitations.

Record the analysis revision, checkpoint and reason for each supplement. If the acquisition quality is unresolved, retain that qualifier with every derived use: C09's supplied session/client row remains informative while its source-object and byte-integrity fields remain missing. Missing metadata neither proves the row false nor authorizes calling it verified.

**Practice and limit.** Complete [EX021](#exercise-ex021) with the seven core source entries and explicit C11/C12 supplements, then show what a frozen 09:22 version excludes. Compare the [worked answer](#answer-ex021). A traceable timeline exposes contradictions and release boundaries; it cannot establish actor, source authenticity or an unmeasured historical state.

**Continue studying — course Day 21:** [Previous: Week 4, Day 20](#week-04-day-05) · [Week 5 index](#ch-05) · [Course index](../SUBJECTS.md) · [Next: Day 22](#week-05-day-02).

### Exercise for this lesson

<a id="exercise-ex021"></a>
**EX021 — Source-traceable timeline.** Objective: reconstruct event and knowledge order without rewriting a checkpoint. Input: C02–C12 through 09:26 and Day 21. Produce at least seven core source entries with event time/range, raw/derived time, ingestion where supplied, case receipt/release, source ID and limitation; add explicit C11 and C12 supplements. C11's alleged addendum time remains unknown; C12 supplements C05's 09:01 event rather than adding a new edit. Identify what a frozen 09:22 version excludes. Rubric: 0 = future-card use, invented event/approval time or repaired chronology; 1 = source-linked timeline but missing uncertainty, supplements or version boundary; 2 = reproducible time annotations, both later supplements and intact earlier checkpoint. [Worked answer](#answer-ex021).

## Worked answers

<a id="answer-ex021"></a>
**EX021 — Model timeline.** A valid seven-entry core is: C06 approval 08:50 (retrieved 09:10; S40–S41 only); C04 raw 08:54/normalized approximately 08:58 (ingested 09:06, released 09:09; no session); C03 sign-in 08:58 (ingested 09:02, released 09:09; account, not human); C02 noticed around 09:00 (received 09:04; reporter estimate); C05 edit 09:01 (ingested 09:07, released 09:09; `q-144`, blank session); C09 detail rows 08:58/08:59 (received 09:18; missing original-object metadata); C10 displayed 11:21 UTC+02:00, conditional 09:21 UTC (received 09:22; capture clock/cache unverified). Add C11 at 09:24 as an unverified statement about an addendum, and C12 at 09:26 as a supplement to C05's reported 09:01 edit; these two supplements are required for the final 09:26 artifact. Keep a separate release/receipt column so the 09:04 analyst does not “know” C12.

**Additional worked reasoning (EX021 — Reconstruct the sources, not only the order.):** Seven sufficient entries include: C06 approval event 08:50 **released 09:10** (S40/S41 only); C04 raw 08:54 estimated 08:58, ingested 09:06/released 09:09 (no session); C03 IdP 08:58, ingested 09:02/released 09:09 (`s-77`, no person); C02 approximately 09:00 symptom/09:04 receipt (report); C05 09:01 edit/09:07 ingestion/released 09:09 (`q-144`, blank session); C09 detailed identity events 08:58/08:59, received 09:18 (missing object/integrity metadata); C10 displayed 11:21 UTC+02:00 *conditionally* 09:21 UTC, received 09:22 (unknown clock/cache). C11 at 09:24 and C12 at 09:26 can be added **only** in the later final timeline. Each row includes exact card pointer and limitation; a time-sorted story without receipt/release does not meet the required artifact.

**Week 5 Day 21 — worked version boundary.** Retain the seven core entries above and add two supplements. C11: support statement supplied 09:24, claimed S42 addendum not attached, effective approval time not supplied, change-authority referral pending. C12: read-only application view supplied 09:26, pointing back to C05's 09:01 `q-144` edit, adding only self-reported `batch-17`; no validated origin or current-state result. A frozen 09:22 timeline excludes both supplements, even though C12 describes the earlier request. Retain C02's approximate symptom time, C04's raw/corrected pair and separate ingestion/release, and C10's conditional display/receipt distinction. A revised table can add knowledge without altering the old source strings or pretending the analyst had the tag earlier. Two points require the explicit C11/C12 rows as well as the core provenance fields; sorting times alone is insufficient.