Purpose and when to use it
Use corroboration whenever a consequential inference depends on one source, a generated assertion, or an uncertain parser interpretation. Seek conflicts as deliberately as agreement.
Evidence required
Inventory the source of each record, its collection path, upstream data, clock, and relationship to the proposition. Independent service receipts or affected-file versions may help test an agent’s claim.
Principles and procedure
- State the proposition to be corroborated and the specific observation each source contributes.
- Map shared backends, copies, exporters, tools, and asserted origins.
- Compare independent records for agreement and contradiction, using identifiers before timing alone.
- Explain remaining dependencies and update the claim only to the extent the added evidence supports it.
What to document
Keep a source-dependence map and claim-to-record references. Document why a source is independent for this proposition rather than merely different in format or location.
Failure modes
Circular citations, mirrored logs, and ensembles built on related detectors can multiply apparent support without adding independent evidence. Selecting only matching records conceals important counterevidence.
Limits on the conclusion
Independence is often partial and proposition-specific. Agreement can still arise from a common error, while an apparent conflict may reflect different events or clock semantics.
Independent checks and corroboration
Test source relationships themselves: compare identifiers, acquisition paths, upstream dependencies, and known synchronization behavior. Do not call a source independent solely because another organization holds a copy.
How to report the result
Report support, contradiction, and dependence together. Explain whether corroboration concerns the underlying event, the object’s integrity, or only the correctness of a derived view.
Related glossary terms
Are these sources actually independent?
Trace each record to its producer and upstream inputs. A dashboard, email, and exported log may all repeat one backend event. Compare them with a source that independently tests the proposition, such as an acquired target file or service audit record.
Explain independence for the specific claim. Several consistent displays can support persistence or presentation while providing only one underlying account of the historical action.
Sources & further reading
Source verification checks the official publication and its scope. It is separate from independent technical review of this reference page.
- NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response
IT-oriented forensic process and sources; published 2006. It is not a complete investigative procedure or legal advice.
Canonical reference: https://syntheticforensics.org/methods/corroboration/
Report a technical correction