Learn how professional fictional investigators compare supplied records across identity, endpoint, application, service, supplier, and audit sources without turning shared identifiers or nearby timestamps into unsupported stories. Preserve provenance, time meaning, source health, transformation, duplication, contradiction, alternatives, attribution limits, and uncertainty.
Lesson Progress
High School Advanced • A8: Digital Forensics Concepts • Lesson 7 of 10
Readiness Check
0/6 ready
Professional Hook
A fictional service event appears in the source system, a normalized case record, and a dashboard. The three rows share the same event ID but show times of 14:01, 14:06, and 14:07. A rushed investigator counts three events and reports repeated activity.
The source owner explains that 14:01 is event time, 14:06 is processing time, and 14:07 is case receipt time. The records are useful, but they are not independent evidence of three separate events. Correlation begins by understanding lineage before counting, comparing, or interpreting.
Weak correlation
“Three records with nearby times mean three separate events.”
Professional correlation
“The three fictional records share one event ID and documented lineage, so they are best treated as multiple representations of one event.”
Learning Objectives
Objective 1
Correlate supplied fictional identity, endpoint, application, service, supplier, and audit records around one bounded forensic question instead of joining every available record.
Objective 2
Preserve fictional evidence identity, provenance, source health, time type, transformation, duplication, missing fields, and ownership while comparing records.
Objective 3
Distinguish strong, moderate, weak, conflicting, duplicate, unrelated, and Unknown relationships without treating shared identifiers or nearby timestamps as automatic proof.
Objective 4
Build a fictional correlation matrix that records the relationship question, supporting evidence, contradiction, alternatives, confidence, limitations, and next owner action.
Objective 5
Write bounded fictional correlation findings that separate observation, relationship, attribution, causation, intent, and impact while protecting privacy and scope.
Why It Matters
One fictional source rarely answers every forensic question. An identity record may explain account state, an endpoint record may explain device context, an application record may explain workflow activity, a service record may explain session state, and a supplier record may explain dependency timing. Correlation can connect those pieces into a stronger picture.
Correlation is also where confirmation bias can become a polished narrative. Shared account references, matching service IDs, nearby timestamps, and repeated rows can look convincing even when sources are transformed, duplicated, Degraded, stale, or unrelated. Professional correlation keeps every source's meaning and limits visible.
Combine fictional sources only when the relationship answers the bounded question.
Know whether records are independent or derived from the same underlying event.
Preserve disagreement instead of selecting whichever source fits the hypothesis.
Keep Conditional and Unknown relationships visible rather than forcing a complete story.
Core Framework
Only correlate fictional records when the relationship helps answer the approved forensic question.
Correlation risk
Joining everything can create accidental stories, privacy overreach, and irrelevant complexity.
Professional control
Write the relationship question first and identify the minimum necessary sources.
Records should remain tied to fictional evidence IDs, sources, owners, versions, and transformations.
Correlation risk
Similar-looking values may be mistaken for the same event.
Professional control
Preserve provenance, source lineage, and evidence identity before comparing fields.
Nearby timestamps must represent comparable time types before they support a temporal relationship.
Correlation risk
Event, processing, receipt, and review times can look close while describing different stages.
Professional control
Label time meaning before comparing chronology.
A missing record matters only if the source could reliably have recorded it.
Correlation risk
Blind or Degraded sources can turn missing data into false absence conclusions.
Professional control
Preserve source health in every correlation decision.
A correlation may connect an account, device, session, service, or workflow without identifying a physical person.
Correlation risk
Object relationships can become unsupported person-level blame.
Professional control
State the exact objects connected and preserve attribution limits.
Conflicting fictional evidence should remain visible instead of being discarded because one source fits the hypothesis better.
Correlation risk
Selective correlation creates confirmation bias.
Professional control
Record both sources, owner explanations, source health, and unresolved conflict.
Strong fictional correlation survives comparison against plausible benign, timing, automation, synchronization, and source-health explanations.
Correlation risk
One plausible story can become the only story.
Professional control
Document alternatives and what evidence strengthens or weakens each.
Every fictional correlation finding should declare how strong the relationship is and why.
Correlation risk
A polished narrative may sound more certain than the evidence.
Professional control
Include confidence, limitations, contradiction, alternatives, and non-proof language.
Vocabulary
The fictional reasoning process of comparing two or more supplied evidence items to decide whether they support a meaningful relationship for a bounded question.
A fictional shared reference such as an account, session, service, event, device, workflow, or case identifier used to compare records.
A fictional classification describing how strongly supplied evidence supports a connection between records.
Two or more fictional records that reinforce the same bounded observation while preserving each source's limitations.
A fictional relationship where traceable records materially disagree and require explanation rather than silent selection.
Multiple fictional records that may represent one underlying event or state rather than independent events.
A fictional change in representation such as normalization, filtering, aggregation, export, or summary that may change fields or timing context.
A fictional record attribute that is absent or unavailable and may limit comparison or confidence.
A fictional state such as Healthy, Conditional, Degraded, Blind, Conflicting, or Recovering that affects evidentiary weight.
A plausible fictional explanation that fits the supplied evidence without requiring the first hypothesis to be true.
A sentence explicitly stating what correlated fictional evidence still does not establish.
The approved fictional boundary defining which evidence categories, identities, systems, periods, and questions may be compared.
Source Catalog
Fictional role, authentication, account-state, approval, and session records.
Owner: Identity owner
Strength
Useful for account and access context when source health and timing are clear.
Limit
Does not automatically identify the physical person or establish intent.
Fictional device identity, application state, session association, update, configuration, and local event summaries.
Owner: Endpoint owner
Strength
Useful for device and local-state relationships.
Limit
Shared-device, stale-state, automation, and synchronization context may weaken attribution.
Fictional workflow, request, result, application-state, and change records.
Owner: Application owner
Strength
Useful for application behavior and workflow-state questions.
Limit
May be transformed, delayed, or incomplete and does not independently prove intent.
Fictional session, service-state, request, response, and availability records.
Owner: Service owner
Strength
Useful for service context and timing.
Limit
May describe downstream effects without proving origin or cause.
Fictional dependency-state, maintenance, timing, status, and notification records.
Owner: Supplier owner
Strength
Useful for external dependency and service context.
Limit
Forwarded or summarized supplier records may have provenance and timing limits.
Fictional approval, ownership, change, review, and decision records.
Owner: Governance owner
Strength
Useful for authorization, policy, ownership, and decision context.
Limit
Approval records describe intended governance state, not every actual action.
Fake Dashboard
Northbridge A8 exercise — invented evidence only
Correlation questions
6
Each tied to one bounded forensic decision
Sources represented
6
Identity, endpoint, application, service, supplier, audit
Potential duplicates
1
One source event represented in multiple downstream records
Evidence-limited relationships
3
Conditional, Degraded, and acknowledgement-Unknown cases
Correlation Matrix
Evidence A
Identity record BA-01
Evidence B
Endpoint session record EP-03
Correlation key
Account A + Session S
Source health
Healthy / Conditional
Supports
The account and endpoint records refer to the same fictional session object.
Limitation
The relationship does not identify the physical person controlling shared D-17.
Evidence A
Application record TL-03
Evidence B
Session record BA-02
Correlation key
Service S + event window
Source health
Degraded / Conditional
Supports
The supplied event times overlap the active session interval.
Limitation
Application source degradation prevents complete coverage, and overlap does not prove causation.
Evidence A
Supplier note TL-05
Evidence B
Workflow record TL-03
Correlation key
Dependency + event time
Source health
Conditional / Degraded
Supports
The supplier note reports an earlier dependency-state change.
Limitation
Supplier creation-time provenance is incomplete and causation remains unresolved.
Evidence A
Service source row
Evidence B
Normalized case row
Correlation key
Event ID EVT-44
Source health
Healthy / Healthy
Supports
The records share the same fictional event ID and owner-confirmed lineage.
Limitation
Different processing times should not be counted as separate event times.
Evidence A
Notification BA-04
Evidence B
Later session BA-02
Correlation key
Account A + timeline
Source health
Healthy / Conditional
Supports
The notification was generated before the later session.
Limitation
No acknowledgement evidence exists, so awareness remains Unknown.
Evidence A
Application source gap TL-06
Evidence B
Service session BA-02
Correlation key
14:02-14:18 interval
Source health
Degraded / Conditional
Supports
The application source cannot provide complete coverage for the interval.
Limitation
Missing application records do not prove no related event occurred.
Fake SOC Alert
Source: Supplied fictional evidence • Time: Fictional review window
Relationship States
Multiple traceable fictional records independently support the same bounded relationship with healthy or well-understood sources.
Reporting behavior
State the supported relationship and still include non-proof limits.
The relationship is supported, but timing, transformation, attribution, or source-health limits remain.
Reporting behavior
Use moderate confidence and name the exact limitation.
A plausible relationship exists, but provenance, source health, missing fields, timing, or context significantly limits confidence.
Reporting behavior
Keep the finding Conditional and avoid using it as sole support.
Traceable fictional sources materially disagree about the same relationship.
Reporting behavior
Preserve both records and the unresolved conflict.
Multiple fictional records likely represent one underlying event or state.
Reporting behavior
Avoid double-counting while preserving each representation and lineage.
The fictional records do not materially help answer the same bounded question.
Reporting behavior
Do not force a connection because identifiers or times happen to be similar.
The supplied fictional evidence is insufficient to decide whether a meaningful relationship exists.
Reporting behavior
Preserve Unknown and identify the owner clarification needed.
Fake Log Panel
14:01 | IDENTITY | account=Account-A | session=Session-S | result=success | evidence=BA-01 14:01 | ENDPOINT | endpoint=D-17 | session=Session-S | account=Account-A | shared=true | evidence=EP-03 14:04 | APPLICATION | workflow=Workflow-W | state=unusual-transition | source_health=Degraded | evidence=TL-03 14:06 | SERVICE | event_id=EVT-44 | stage=processing | source_event_time=14:01 | evidence=SR-02 14:07 | CASE | event_id=EVT-44 | stage=receipt | lineage=service-source | evidence=CS-11 13:58 | SUPPLIER | dependency=Dependency-R | state=changed | provenance=Conditional | evidence=TL-05 14:12 | CORRELATION | account+endpoint=Supported | person_attribution=Unknown | causation=Unknown
Training note: this is fake data for defensive analysis practice only.
Analyze the Evidence
Time and Correlation
A fictional identity event at 14:01, application event at 14:04, service processing event at 14:06, and case receipt at 14:07 may belong to one sequence—or may simply be different stages and independent events. Before comparing proximity, investigators must identify which times are event, processing, receipt, or other time types.
Are the fictional timestamps both event times, or are different lifecycle stages being compared?
Are the times exact, rounded, approximate, or interval-based?
Do the fictional sources share a comparable timezone context?
Could processing, synchronization, forwarding, or ingestion delay explain the difference?
Was either fictional source Degraded, Blind, Conditional, or transformed?
Does the supplied evidence show more than sequence or overlap?
Duplicates
A source event may generate a normalized row, an alert, a dashboard entry, a case record, and a report summary. Those records can be valuable because they show processing and decision context, but they may all trace back to one original observation.
Do the fictional records carry the same event or object identifier?
Does one fictional record explicitly derive from another?
Was the fictional event normalized, summarized, filtered, or enriched downstream?
Are later times processing or receipt times rather than separate event times?
Can the fictional source owner confirm whether the rows represent one or multiple events?
Can the case preserve all representations without counting them as independent observations?
Analyze the Evidence
Contradictions
Source A
A fictional service source shows event time 14:01.
Source B
A normalized case row shows 14:06.
Possible explanation: The second value is processing time for the same event.
Professional handling
Preserve both time types and classify the rows as duplicate representations rather than a contradiction.
Source A
A fictional identity record shows temporary role active at 14:04.
Source B
A downstream summary shows normal role state at 14:04.
Possible explanation: The summary updates every fifteen minutes and may be stale.
Professional handling
Treat the downstream summary as freshness-limited and request owner clarification before calling the records conflicting.
Source A
A fictional service record shows a session during the interval.
Source B
The application source shows no matching event.
Possible explanation: The application source was Degraded for much of the same interval.
Professional handling
Do not treat missing application evidence as contradiction or absence proof.
Source A
A fictional supplier note reports 13:58.
Source B
A service owner expected the dependency change after 14:00.
Possible explanation: Supplier creation-time provenance is incomplete and owner expectation is not direct event evidence.
Professional handling
Keep timing Conditional and separate recorded evidence from owner expectation.
Scenario Decision Lab
A fictional service session is active from 14:01 through 14:19. The application source shows no matching event at 14:10, but that source was Degraded from 14:02 through 14:18.
Alternative Explanations
Bounded conclusion
Correlation supports object-level relationship, not automatic person attribution or harmful intent.
Bounded conclusion
Sequence supports a causal question, not a causal conclusion.
Bounded conclusion
Timing does not prove awareness, consent, or action.
Bounded conclusion
Presence on both endpoints does not establish origin or coordinated human action.
Professional Workflow
Define exactly which fictional objects, time range, and decision the correlation should address.
Choose only fictional evidence categories necessary to answer the relationship question.
Record evidence IDs, source owners, provenance, transformation, and lifecycle status.
Compare identifiers and time context without erasing original values or source-specific meanings.
Identify Blind, Degraded, Conditional, transformed, or incomplete evidence before interpreting absence.
Determine whether multiple fictional rows are independent evidence or representations of one source event.
Keep both reinforcing and conflicting fictional records visible.
Compare benign, timing, automation, synchronization, shared-device, source-health, and process explanations.
Use Strong, Moderate, Conditional, Conflicting, Duplicate, Unrelated, or Unknown states with reasons.
State the fictional relationship, support, limits, non-proof statements, and next owner action.
Scenario Decision Lab
A fictional supplier note reports a dependency change at 13:58. A workflow event occurs at 14:04. The supplier note reached the case later and its original creation-time provenance remains incomplete.
Privacy and Scope
The ability to connect fictional records across systems does not justify broad review. Correlation scope should remain tied to one approved question. Adding more sources can expose unrelated identities, browsing activity, messages, personal information, supplier details, or internal configuration without improving the finding.
Reporting Language
Reporting pattern 1
Overstated
The identity and endpoint logs prove Person A used D-17.
Bounded
The fictional identity and endpoint records correlate Account A with Session S on shared Endpoint D-17; the supplied evidence does not independently establish the physical person controlling the device.
Reporting pattern 2
Overstated
The supplier change caused the workflow event.
Bounded
The fictional supplier note reports a dependency-state change before the workflow event, but supplier provenance is Conditional and the current correlation does not prove causation.
Reporting pattern 3
Overstated
Two alerts mean two separate events.
Bounded
The fictional records share one event identifier and owner-confirmed lineage, so they are best treated as duplicate representations unless additional evidence establishes separate events.
Reporting pattern 4
Overstated
No application record means the event did not happen.
Bounded
No matching fictional application record is visible, but the source was Degraded during the interval; absence remains unsupported.
Reporting pattern 5
Overstated
The notification proves the user knew about the change.
Bounded
The fictional notification was generated before the later session; acknowledgement and person-level awareness remain Unknown.
Reporting pattern 6
Overstated
The browser state on both devices proves coordinated activity.
Bounded
The fictional browser state was reflected on two approved endpoints within the expected synchronization interval; coordinated human activity and origin are not established.
Common Mistakes
Why it fails
Broad fictional correlation can create irrelevant relationships, privacy exposure, and confirmation bias.
Professional correction
Correlate only sources needed for the bounded question.
Why it fails
Shared identifiers may represent a session, account, service, or reused object rather than one event.
Professional correction
Use evidence identity, lineage, time type, and owner context.
Why it fails
Downstream normalized, alert, case, dashboard, and report rows may all derive from one source event.
Professional correction
Distinguish independent evidence from duplicate representations.
Why it fails
Temporal proximity supports a relationship question, not automatic cause.
Professional correction
Preserve sequence separately and test alternatives.
Why it fails
Blind, Degraded, delayed, filtered, or retention-limited sources may omit evidence.
Professional correction
Use source-limited or Unknown conclusions.
Why it fails
Different time types, stale state, transformation, precision, or source health can explain disagreement.
Professional correction
Preserve both records and investigate the reason for conflict.
Why it fails
Shared devices, stale sessions, automation, delegated use, and synchronization can weaken physical-person conclusions.
Professional correction
State the exact object relationship the evidence supports.
Why it fails
A fictional source with known limits can still support narrow conclusions.
Professional correction
Use bounded confidence and avoid sole reliance where the limitation is material.
Safe Fictional Lab
Use only CR-01 through CR-06 and the invented records supplied on this page. Do not access, search, query, collect, export, monitor, correlate, capture, extract, or inspect any real logs, accounts, devices, applications, services, suppliers, networks, school systems, websites, or people.
Lab boundary
This activity is a reasoning and documentation exercise using invented, pre-supplied records only. It does not authorize real log collection, querying, export, monitoring, network capture, account access, device access, private-message review, storage access, extraction, surveillance, or investigation of real people or systems.
Advanced Challenge
A fictional identity source and endpoint source strongly correlate Account A with Session S on D-17. The application source shows no matching event—but the application source was Degraded during most of the relevant interval. Leadership asks whether the missing application row disproves the account-to-endpoint relationship.
Defender Habits
Check Your Understanding
Choose your answers first. Explanations appear only after submission.
Portfolio Prompt
Create a fully fictional A8.7 Cross-Source Forensic Correlation Workbook for Northbridge. Include at least ten invented evidence items across identity, endpoint, application, service, supplier, and audit/governance sources. For each correlation include relationship question, evidence IDs, source owners, provenance state, source health, time type, correlation key, transformation, duplicate status, missing fields, supporting relationship, contradiction, alternative explanation, confidence, attribution limit, causation limit, privacy limit, next owner question, and bounded reporting language. Include one Strong supporting correlation, one Moderate correlation, one Conditional correlation, one probable duplicate, one Conflicting relationship, one Unrelated relationship, one Unknown relationship, one Degraded-source absence case, one supplier-provenance case, one shared-device attribution limit, one notification-awareness limit, at least eight non-proof statements, a leadership summary, and a public-safe portfolio summary. Every organization, person, account, endpoint, session, application, service, supplier, event, source, timestamp, owner, finding, and outcome must be invented.
Confidence / Readiness Reflection
Rate your readiness from 1 to 5 for correlation questions, source selection, evidence identity, provenance, time type, source health, duplicates, contradictions, alternatives, confidence, attribution limits, and bounded reporting.
Key Takeaways
Safety Boundary
Nothing in A8.7 authorizes access, investigation, monitoring, querying, log collection, export, network capture, account access, device access, application access, storage access, private-message review, extraction, credential use, surveillance, configuration changes, or cross-system investigation involving any real device, account, application, service, supplier, network, organization, incident, classmate, teacher, family member, or other person. Use only fully invented, pre-supplied evidence records.
Lesson Complete
A8.7 established how to connect fictional evidence across multiple sources while preserving source meaning, lineage, contradictions, alternatives, and confidence. A8.8 turns those findings into a professional forensic report with purpose, scope, evidence, chronology, findings, limitations, review, versioning, distribution, and public-safe communication.