Version
1.1.0
Published / updated
Reference status
Reference
Author / editor attribution
Jesse Shelley

Purpose and when to use it

Use corroboration whenever a consequential inference depends on one source, a generated assertion, or an uncertain parser interpretation. Seek conflicts as deliberately as agreement.

Evidence required

Inventory the source of each record, its collection path, upstream data, clock, and relationship to the proposition. Independent service receipts or affected-file versions may help test an agent’s claim.

Principles and procedure

  • State the proposition to be corroborated and the specific observation each source contributes.
  • Map shared backends, copies, exporters, tools, and asserted origins.
  • Compare independent records for agreement and contradiction, using identifiers before timing alone.
  • Explain remaining dependencies and update the claim only to the extent the added evidence supports it.

What to document

Keep a source-dependence map and claim-to-record references. Document why a source is independent for this proposition rather than merely different in format or location.

Failure modes

Circular citations, mirrored logs, and ensembles built on related detectors can multiply apparent support without adding independent evidence. Selecting only matching records conceals important counterevidence.

Limits on the conclusion

Independence is often partial and proposition-specific. Agreement can still arise from a common error, while an apparent conflict may reflect different events or clock semantics.

Independent checks and corroboration

Test source relationships themselves: compare identifiers, acquisition paths, upstream dependencies, and known synchronization behavior. Do not call a source independent solely because another organization holds a copy.

How to report the result

Report support, contradiction, and dependence together. Explain whether corroboration concerns the underlying event, the object’s integrity, or only the correctness of a derived view.

Related methods

Related glossary terms

Are these sources actually independent?

Trace each record to its producer and upstream inputs. A dashboard, email, and exported log may all repeat one backend event. Compare them with a source that independently tests the proposition, such as an acquired target file or service audit record.

Explain independence for the specific claim. Several consistent displays can support persistence or presentation while providing only one underlying account of the historical action.

Sources & further reading

Source verification checks the official publication and its scope. It is separate from independent technical review of this reference page.

  1. NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response

    IT-oriented forensic process and sources; published 2006. It is not a complete investigative procedure or legal advice.

    NIST · Primary · Last verified 2026-10-09

Canonical reference: https://syntheticforensics.org/methods/corroboration/

Report a technical correction