Source eligibility
A record is eligible only when publicly accessible without authentication or access-control circumvention at capture time. Private messages, access-controlled profiles and authentication-gated content are excluded. Later removal or a visibility change does not expand the original capture.
Record the observation
Retain the source reference, collection method, observed fields and capture timestamp. Keep source-provided publication time separate from collection time. Mark missing fields, failed requests and coverage gaps; do not fill them with inferred content.
Preservation after change
A stored public observation can remain after its live source changes or disappears, within the agreed retention scope. Content never captured cannot be recovered by this workflow. An unavailable source response alone does not establish deletion, cause or intent.
Integrity checks
Use reproducible digest verification where implemented and retain the original capture artefact and transformation history. A matching hash supports byte-integrity checking, not authorship, truth, lawful collection or completeness. Shortened illustrative hashes in example records are not operational proofs.
Chain of custody and attributable logging
Chain of custody requires attributable capture, query, access and export records, including actor, event, record reference, time, transfers and modifications. Verify those controls in the actual deployment. Disclose gaps rather than claiming a complete handling history when records are missing.
Analyst inference and evidence handoff
Separate observation from inference, list alternative explanations and keep supporting captures attached to candidate links. A report must state source scope and limitations. Authentication and admissibility require case-specific legal review; no outcome is guaranteed.
Measurements and validation
A published count must specify the index query, record definition, deduplication scope and authoritative measurement date. No index-backed measurements or dates have been supplied for public publication, so figures remain undisclosed. Demonstrate collection and deployment controls during evaluation before operational reliance.