SIMULATED INCIDENT EVIDENCE — SIM-2026-001

All records, interviews, change records, times and conclusions are invented.
No real employer, account, incident or assessment is represented.

Save manifest.json and all six JSON logs in the same directory. The manifest
contains actual SHA-256 hashes of these fixture bytes, event counts, source
coverage, and context records (CTX- IDs). Locate an EVT- ID using its source
and /events/<zero-based index> pointer. Context records are in manifest.json.

The JSON is an educational normalization, not a native product export.
originalTime retains its offset; normalizedUtc adds clockCorrectionSeconds
to the parsed original instant. CTX-003 explains the marked -120-second
Windows corrections. ingestedUtc is a separate collection-pipeline time.

Network detail is missing Oct 13 09:30–10:15 UTC. Recipient-device evidence,
memory acquisition and WS-014 telemetry are absent. A successful cloud
download operation does not establish the final recipient or full data theft.

Snapshot: 2026-10-14T16:00:00Z. The incident remains open. Hashes demonstrate
fixture consistency only; they do not authenticate real original evidence.
Keep actual investigation evidence in an approved private repository.