Evidence: test what the record supports.

A source is not a verdict

A genuine document can contain an inaccurate statement. A screenshot can faithfully capture an untrue post. Separate “this record exists,” “this person said this” and “the underlying event happened.” Each needs its own support.

DRTE’s labels describe research status, not courtroom admissibility or a legal burden of proof. Read Fact Labels and the publication safeguards before drawing public conclusions.

Test a claim in both directions

1. Write one narrow question and one proposed explanation. Avoid labels such as “fraud” when you have only a discrepancy.
2. List what would be expected if the explanation were correct and what would be expected under an innocent alternative.
3. For each item, identify the exact part that supports, contradicts or is neutral to the explanation. Record the limitation beside the claim, not in a distant footnote.
4. Ask whether the source witnessed the event, has an interest, copied another source or supplied an incomplete record. Distinguish source independence from repetition.
5. Look actively for records that could clear the person or organization and disprove your favored explanation. Failure to prove innocence is not evidence of guilt.
6. Seek the missing record that would distinguish alternatives. Leave the result unresolved if the record does not decide it.
7. Write a short conclusion proportional to the evidence: what is established, disputed and unknown; then name the next check. Do not assign an invented probability or treat agreement with AI as corroboration.

Use an evidence ledger

Fields: claim ID · neutral claim/question · supporting item IDs and exact locations · contradicting item IDs · alternative explanation · source independence · authenticity/completeness concerns · current label · next action · reviewer/date.

Fictional example: A request response is dated September 7, but the email arrived September 9. Possible explanations include ordinary mailing delay, later processing or a date error. The two dates alone do not prove deception. The next useful record may be a sending log, not another opinion about the dates.

Modern digital clues: useful, but limited

• Metadata: inspect a working copy and retain raw fields. Software, transfers and editing can change or strip values. Compare against independent records; see the metadata procedure.
• AI and manipulated media: request provenance and the earliest available file, compare surrounding footage and independent sources, and record what tools did. An AI detector score or reverse-image match is a lead, not proof of fabrication or authorship. Never upload confidential case files to an unapproved AI service.
• OCR: searchable text generated from a scan can misread names, dates and amounts. Verify every quoted passage against the page image. Keep OCR as a labeled derivative.
• Audio transcription: note uncertain words, speaker uncertainty and timestamp references. Do not “clean up” a statement into a stronger claim. Preserve the original recording and keep enhanced copies separately.

IP addresses: document a network clue, not a person

Use only IP addresses already present in material you are authorized to access, such as your own service logs or an email received by you. Do not use tracking links, account intrusion or attempts to expose a private person’s location.

1. Preserve the original log or message. Record the IP exactly, event time with time zone, service, relevant log field and what that service says the field represents. Keep related port information if already provided.
2. For a received email, export the full message and headers using the mail provider’s instructions. In Gmail on a computer, open the message, choose More beside Reply, then Show original. Save the original when available. See Gmail’s full-header instructions. Display names and arbitrary header fields are not automatically trustworthy.
3. Use ARIN’s public Whois/RDAP lookup to check the network registration. Follow referrals to the responsible registry. Save the result and lookup date, including the network range and organization; distinguish current registration from historical use.
4. Write the limited finding: “The registry lists this network organization,” not “this individual sent it.” Provider relays, VPNs, shared networks and address reassignment can separate a network address from a person.
5. If subscriber identification is necessary, consult appropriate legal or investigative professionals about lawful provider records. Do not confront someone based on a lookup.

ARIN’s records identify network-resource registrations, not a guaranteed physical location or a subscriber identity. Sources: ARIN lookup guide and ARIN’s information and limits. A geolocation estimate is not a street address; traceroute shows routing hops, not a person’s trail.

Before sharing a conclusion

• Check the full source and exact quotations again. Keep adverse and exonerating material in the analysis.
• Separate verified records, allegations, opinions and unresolved hypotheses. A missing answer does not establish wrongdoing.
• Review privacy and permanent redaction on a separate publication copy. Do not publish personal IP addresses or other identifiers merely because you collected them.
• Apply DRTE’s right-of-reply and publication safeguards. Keep questions, deadlines and responses in the case file.
• If authenticity, device recovery, legal restrictions or admissibility matter, stop short of certainty and obtain qualified review.