1. Take the briefing literally—but not as proof
Your client tells you what they fear, what they remember and what they want answered. That briefing gives you a question, not a verdict. Write down the claims that can be tested by time, place, identity or transaction.
2. Search laterally
A message can establish what somebody said. It rarely proves where they were. Move between chats, maps, health, calendars, photos and transactions until two independent records meet.
- Separate plans from events.
- Separate an account or credential from the person using it.
- Prefer server timestamps and original files to screenshots or cropped alerts.
3. Answer from the chain
Each case asks twelve evidence questions. Type the conclusion in your own words; minor spelling differences are accepted. A wrong answer costs nothing, so revise the hypothesis rather than guessing faster.
4. Reveal hints progressively
Every question includes three hints. The first points toward an app or evidence class, the second narrows the record, and the third gets close to the decisive connection without replacing your conclusion.