Why integration matters
Each data source records time differently. Carriers may report in UTC, devices in local time, surveillance systems on clocks that drift, and vehicles on their own internal clocks. Each source also answers a different question: carrier records show network activity, extractions show what happened on the device, video shows what a camera saw.
Put side by side without reconciliation, these sources can appear to conflict, or appear to agree when they don't. Integrated correctly, they corroborate one another and expose the gaps. This is the work the practice is named for.
Sources we integrate
- Call detail records and data sessions
- Historical cell site and timing advance data
- GPS and app-based location records
- Device extraction artifacts
- Social media and platform returns
- Surveillance, body-worn, and dash camera video
- Vehicle telematics and infotainment data
- Open-source and third-party records
What you receive
- A normalized, time-corrected timeline with every entry traced back to its source record
- Clear identification of where sources corroborate, conflict, or leave gaps
- Visual timelines and maps suitable for reports, hearings, and trial
- A plain-language narrative of what the combined evidence shows, and what it doesn't
Background in this work
Andrew McDermott spent years building multi-source digital timelines in serial shooting, homicide, organized crime, and counterterrorism investigations. He has taught digital evidence integration, pattern-of-life analysis, and data synthesis to investigators and prosecutors nationwide, and contributed practitioner input to the development of the Nighthawk digital data visualization platform.