Studying what incomplete evidence still allows.

Most investigations contain records with missing time, incomplete collection or ambiguous relationships. Our work studies how to reason about those limitations without replacing them with a conveniently certain story.

Experimental codeNot part of the production customer workflow.

The starting problem

A log gives you observations. Not a complete account of reality.

Illustrative two-event model / not real case data

Source event ASource event B

History 01A before B

History 02B before A

Both strict orderings fit when the record establishes no ordering constraint. This simplified diagram does not model simultaneity, missing events or real source clocks.

Current areas of investigation

Four questions, with explicit limits.

These components exist as bounded research implementations and are not enabled for production customers. Independent operational and human evaluation remains necessary.

Ordering without a reliable clock

Which event orderings remain possible?

Partial-order and temporal-constraint models retain alternatives when records are incomplete or source clocks lack calibration.

Constraint: A modeled ordering is not proof that events occurred in that sequence.

Choosing another measurement

What observation could separate competing accounts?

Bounded experiments compare proposed checks with their modeled discriminatory value, estimated collection effort and access limits.

Constraint: A useful potential check does not guarantee an obtainable result.

Testing collection coverage

Would a missing event have been recorded?

Source inventories, parser limitations and signed claims help identify what remains unverified about telemetry coverage.

Constraint: An authenticated declaration does not prove the source was complete.

Working with a negative result

When can an empty result challenge a history?

The research engine can conditionally compare independently reviewed source claims with a bounded set of possible histories.

Constraint: No experimental absence claim can become a customer finding.

Research standards

A convincing diagram is not validation.

We use explicitly constructed test cases to compare temporal conclusions against an independent constraint reference. Those synthetic checks can expose an unsupported ordering claim; they cannot establish that the system improves real incident investigation.

Evidence from actual use would require independent technical review, controlled comparisons, privacy assessment, and observation of how investigators handle misleading or inconclusive results.

Read PastePile security boundaries