After capturing public posts on three platforms, the timestamps conflict with the claimed incident window. How should the OSINT report present that?
Select an answer to reveal the explanation.
Short Explanation
Conflicting clocks are part of the evidence, like three watches that do not agree after a power blip. Show each sourced time instead of sanding the story until it matches the 311 ticket. An honest timeline beats a neat one.
Full Explanation
After capturing public posts on three platforms where timestamps conflict with the claimed incident window, the OSINT report should publish a sourced timeline that includes the contradictions rather than smoothing them away. Conflicting clocks are evidence in municipal incident reconstruction, not inconveniences to erase for narrative comfort. Dropping inconvenient timestamps so the story matches the 311 ticket fails by fabricating coherence the sources do not support and by misleading responders. Averaging the three platform times into a single official incident minute fails by inventing a time nobody published. Treating platform clocks as authoritative without recording retrieval times fails because display times, time zones, and edits need capture metadata beside them. Exam caveat: platform times can be edited, delayed, or zone-shifted—retrieval time and screenshot context matter for later audit. Operational check: list each post’s displayed time, URL, and retrieval time; show conflicts explicitly; let investigators reconcile with 311 data without OSINT sanding the timeline into a false single minute. In municipal practice, record the rationale in the case file so future staff know which control was chosen and which failure modes the rejected options would create for city services.