The pattern, documented

The Evidence

A chain of five events, in order. Each one is a verifiable act against the record — and the sequence itself is the proof. This page presents the pattern; the raw record with specific identifiers remains under private access.

The chain of events

Five acts against the record

Preservation

What can still be recovered

"Erased" is not gone

A change to the partition table, filesystem, or encryption layer leaves the underlying sectors intact until physically overwritten. A virus targets access, not full overwrite.

Preserve before touching

Do not power on the drive, write a byte to it, or let any tool "repair" it. Obtain a raw sector-by-sector forensic image first.

The phone may still testify

A power surge kills the power circuitry, not necessarily the flash memory. A chip-off / direct flash read may recover the original messages.

The email is not lost

The provider retains server-side data. Deleted-message recovery and a legal demand may recover the account content.

Legal significance

Why the sequence is the proof

Adverse inference

Spoliation presumes the destroyed or altered evidence said what the destroyer needed hidden. The act of destruction is itself the testimony.

The sequence

Fabricate, then destroy, then lock out, then attack the backup. A person destroys evidence to hide what it said; a person fabricates evidence to make it say the opposite. You do neither to a record that helps you.

The tiebreaker

For a child, the parent holds the superior claim to the dependency — unless the child lived elsewhere more than half the year and the parent didn't provide half the support. The removal itself created the conditions for the non-parent claim to succeed. Two thefts, each proving the other.