Purpose and when to use it
Use reconstruction for conversation evolution, generated-file history, agent execution, or a sequence of transformations. Choose a timeline, graph, or partial ordering according to the evidence rather than forcing a single sequence.
Evidence required
Collect raw event times, message and parent IDs, task and job IDs, file revisions, tool responses, and affected-system records. Record clock sources and whether events are synchronous or queued.
Principles and procedure
- Extract source-linked events while retaining the raw representations.
- Normalize only understood clocks and distinguish creation, modification, completion, and export times.
- Link events using supported identifiers or relationships; label weaker temporal associations.
- Build competing sequences, preserve unresolved branches, and test claimed effects against affected-system evidence.
What to document
Keep the transformation from source records to reconstructed events inspectable. For every proposed relationship, record its evidence, assumptions, ordering constraint, and known uncertainty.
Failure modes
Sorting display timestamps can conceal branches or reorder delayed jobs. Retries may duplicate an apparent action, and a tool response may precede the eventual external effect.
Limits on the conclusion
A coherent history can still be incomplete. Missing records may prevent ordering, while a restored state may not reveal every step that produced it.
Independent checks and corroboration
Look for independently recorded side effects, source files, and downstream receipts. Disagreements should remain visible until a documented clock or interpretation issue resolves them.
How to report the result
Provide the supported sequence, unavailable intervals, competing histories, and the evidence needed to decide unresolved points. Distinguish attempted actions from verified completion.
Related glossary terms
How do you handle a delayed tool result?
Preserve dispatch, job, completion, and target-system records with their identifiers. Compare raw time values and establish supported ordering constraints. Distinguish the time an action occurred from the time another process learned its result.
Represent a supported interval when clocks or polling introduce uncertainty. Explain alternative sequences where records are missing rather than assigning one exact moment to make the timeline look cleaner.
Sources & further reading
Source verification checks the official publication and its scope. It is separate from independent technical review of this reference page.
- NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response
IT-oriented forensic process and sources; published 2006. It is not a complete investigative procedure or legal advice.
- PROV-DM: The PROV Data Model
A model for entities, activities, agents, and derivation relationships; a W3C Recommendation from 2013.
Canonical reference: https://syntheticforensics.org/methods/reconstruction/
Report a technical correction