Question 1

Why not just rely on the strongest single source?

Accepted Answer

Because a single source, however strong, is a single point of failure (§5, Examples 1 and 3). A phone can be left behind, a screenshot can be challenged, one clock can be wrong. Corroborating a central fact across several independent sources makes the case far more resilient: if one strand is undermined, the others hold. The strength of a modern case is in convergence, so the assembly rests load-bearing facts on more than one source wherever it can.

Question 2

Our sources seem to contradict each other. Is the case lost?

Accepted Answer

Usually not, examine the contradiction rather than fear it (§5, Example 2). Most apparent contradictions between well-collected sources are clock artefacts: different time zones, daylight saving, a DVR running fast, a server in UTC. Normalising every source to a common clock on the master timeline resolves the great majority of them (§4). Where a contradiction is real, it is examined and explained honestly, which is far safer than hiding it and having the opponent expose it.

Question 3

Why does the timeline matter so much?

Accepted Answer

It is the spine of the whole bundle (§4). Placing every event from every source on one timeline, with all clocks normalised, is what makes convergence visible and contradiction resolvable. Without it, the sources are just separate exhibits and the court cannot see how they fit; with it, the case reads as one coherent sequence. Most of the work, and most of the errors, in a multi-source case are in building the timeline correctly.

Question 4

Can one weak exhibit really undermine a strong bundle?

Accepted Answer

Yes, if it is load-bearing (§6, Example 3). A bundle is only as defensible as its least sound source, and if a casually captured, un-provenanced exhibit carries a central part of the case, its collapse under challenge can undermine confidence in the whole and leave that fact unsupported. That is why integrity, hashing, provenance and method, is maintained to the same standard across every source, and why load-bearing facts are corroborated so no single exhibit is indispensable.

Question 5

How is confidence stated for a whole bundle?

Accepted Answer

At the level its weakest necessary link supports, and stated plainly (§5, guide 100). A conclusion that depends on a chain of sources is only as strong as the weakest link in that chain, so the bundle does not claim more certainty than that. Where convergence is strong, confidence is high; where a fact rests on a single or weaker source, that is acknowledged. Honest, calibrated confidence is what lets the whole survive cross-examination.

Question 6

Isn't assembling all this disproportionate for a smaller case?

Accepted Answer

It can be, so scope is matched to the matter (§10, guide 20). Not every case needs six sources for every fact; the principle is that load-bearing facts should be corroborated and the whole should be coherent and sound, at a scale proportionate to what is at stake. For a smaller matter that may mean two well-chosen sources on a clean timeline; for a substantial one it may mean the full estate. The discipline scales; the standards do not drop. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 15 of 17

The Defensible Multi Source Evidence Bundle