{
  "schemaVersion": "1.0",
  "fictional": true,
  "caseId": "SIM-2026-001",
  "snapshot": "2026-10-14T16:00:00Z",
  "contextRecords": [
    {
      "id": "CTX-001",
      "evidenceRefs": [
        "EVT-017",
        "EVT-019",
        "EVT-032"
      ],
      "type": "Simulated interview",
      "time": "2026-10-13T14:00:00Z",
      "statement": "The fictional account holder denies the 09:03 identity, V-77 VPN and C-88 cloud activity. Their ordinary Oct 12 session is recognized. This invented statement corroborates misuse but does not identify a person or acquisition method."
    },
    {
      "id": "CTX-002",
      "evidenceRefs": [
        "EVT-011",
        "EVT-012",
        "EVT-015"
      ],
      "type": "Simulated change record",
      "time": "2026-10-12T17:00:00Z",
      "statement": "CHG-SIM-104 approves it.ops patch task PatchWindow on APP-01 at 18:00–18:15 UTC and the separate svc.backup reader. It does not approve Alex’s ReportCache task on Oct 13."
    },
    {
      "id": "CTX-003",
      "evidenceRefs": [
        "EVT-024",
        "EVT-026",
        "EVT-031"
      ],
      "type": "Simulated clock review",
      "time": "2026-10-13T12:00:00Z",
      "statement": "Time-service review establishes APP-01 was 120 seconds fast during 09:09–09:16 UTC. Apply -120 seconds only to marked Windows records; retain their original strings and offsets. A two-minute adjustment is not an exact network-latency measurement."
    },
    {
      "id": "CTX-004",
      "evidenceRefs": [
        "EVT-037"
      ],
      "type": "Simulated investigation authority",
      "time": "2026-10-13T09:40:00Z",
      "statement": "The exercise incident lead authorizes targeted collection, account/session restriction and APP-01 isolation, with business owner coordination. This is invented exercise context, not authorization for the reader’s environment."
    }
  ],
  "sources": [
    {
      "id": "EVID-IDENTITY",
      "filename": "identity.json",
      "sha256": "d5a3e91bcd0b55705fb25554cc69d047e4b1d84914ce4898ebd793ed19e7f0da",
      "eventCount": 8,
      "coverage": {
        "start": "2026-10-12T00:00:00Z",
        "end": "2026-10-14T16:00:00Z",
        "limitations": "Full selected sign-in/admin events; authentication acquisition history absent."
      },
      "collector": "Simulated evidence custodian",
      "collectedUtc": "2026-10-14T16:00:00Z",
      "eventPointers": {
        "EVT-001": "/events/0",
        "EVT-009": "/events/1",
        "EVT-016": "/events/2",
        "EVT-017": "/events/3",
        "EVT-018": "/events/4",
        "EVT-037": "/events/5",
        "EVT-041": "/events/6",
        "EVT-042": "/events/7"
      }
    },
    {
      "id": "EVID-VPN",
      "filename": "vpn.json",
      "sha256": "12b6e50699ac78e34f2ecd781b1f71d20c0f91c8bf2593f1a268925822277c9f",
      "eventCount": 5,
      "coverage": {
        "start": "2026-10-12T00:00:00Z",
        "end": "2026-10-14T16:00:00Z",
        "limitations": "Session assignment and aggregate counters; counters do not identify files."
      },
      "collector": "Simulated evidence custodian",
      "collectedUtc": "2026-10-14T16:00:00Z",
      "eventPointers": {
        "EVT-002": "/events/0",
        "EVT-008": "/events/1",
        "EVT-019": "/events/2",
        "EVT-038": "/events/3",
        "EVT-040": "/events/4"
      }
    },
    {
      "id": "EVID-WINDOWS",
      "filename": "windows-security.json",
      "sha256": "52f41aa2351400f8d5e9e919c0ca7d15b9e099853520546412f2fd4b47bc10b0",
      "eventCount": 9,
      "coverage": {
        "start": "2026-10-12T00:00:00Z",
        "end": "2026-10-14T16:00:00Z",
        "limitations": "Selected normalized records. APP-01 clock was 120 seconds fast from 09:09 to 09:16 UTC Oct 13."
      },
      "collector": "Simulated evidence custodian",
      "collectedUtc": "2026-10-14T16:00:00Z",
      "eventPointers": {
        "EVT-003": "/events/0",
        "EVT-007": "/events/1",
        "EVT-012": "/events/2",
        "EVT-021": "/events/3",
        "EVT-024": "/events/4",
        "EVT-026": "/events/5",
        "EVT-031": "/events/6",
        "EVT-039": "/events/7",
        "EVT-045": "/events/8"
      }
    },
    {
      "id": "EVID-ENDPOINT",
      "filename": "endpoint.json",
      "sha256": "46085c4a49d1eb66d8df9ef7059f3cfed7ac4915c3d9064e090474238404d54b",
      "eventCount": 11,
      "coverage": {
        "start": "2026-10-12T00:00:00Z",
        "end": "2026-10-14T16:00:00Z",
        "limitations": "Selected process/file/task observations on APP-01; memory and WS-014 absent."
      },
      "collector": "Simulated evidence custodian",
      "collectedUtc": "2026-10-14T16:00:00Z",
      "eventPointers": {
        "EVT-004": "/events/0",
        "EVT-011": "/events/1",
        "EVT-013": "/events/2",
        "EVT-022": "/events/3",
        "EVT-023": "/events/4",
        "EVT-025": "/events/5",
        "EVT-027": "/events/6",
        "EVT-028": "/events/7",
        "EVT-044": "/events/8",
        "EVT-046": "/events/9",
        "EVT-048": "/events/10"
      }
    },
    {
      "id": "EVID-NETWORK",
      "filename": "network.json",
      "sha256": "d8009ae8e375f66d0e27339da5c37e06b003e32a2397a5a439e0188708f5db8b",
      "eventCount": 5,
      "coverage": {
        "start": "2026-10-12T00:00:00Z",
        "end": "2026-10-14T16:00:00Z",
        "limitations": "Selected flows only. Egress detail missing Oct 13 09:30–10:15 UTC; no decrypted content."
      },
      "collector": "Simulated evidence custodian",
      "collectedUtc": "2026-10-14T16:00:00Z",
      "eventPointers": {
        "EVT-006": "/events/0",
        "EVT-014": "/events/1",
        "EVT-020": "/events/2",
        "EVT-029": "/events/3",
        "EVT-030": "/events/4"
      }
    },
    {
      "id": "EVID-CLOUD",
      "filename": "cloud-audit.json",
      "sha256": "e55bddbca2b1262aec7ac029de8433e2ea2dd9c1607d42c24be6da2cdf52ce82",
      "eventCount": 10,
      "coverage": {
        "start": "2026-10-12T00:00:00Z",
        "end": "2026-10-14T16:00:00Z",
        "limitations": "Selected audit operations; no complete recipient device or content-delivery confirmation."
      },
      "collector": "Simulated evidence custodian",
      "collectedUtc": "2026-10-14T16:00:00Z",
      "eventPointers": {
        "EVT-005": "/events/0",
        "EVT-010": "/events/1",
        "EVT-015": "/events/2",
        "EVT-032": "/events/3",
        "EVT-033": "/events/4",
        "EVT-034": "/events/5",
        "EVT-035": "/events/6",
        "EVT-036": "/events/7",
        "EVT-043": "/events/8",
        "EVT-047": "/events/9"
      }
    }
  ]
}