Reconstruct the timeline
Compare messages, access notifications, screenshots and account activity. Place each event in sequence and record its source so that a conclusion can be checked against the original material.
Check the digital context
Look for changes in domains, account names, device activity and platform behavior. Separate a verified record from an interpretation, and document gaps that could affect the assessment.
Prepare a usable evidence record
Organize relevant files and explain their significance in plain English. The review depends on material available with permission; it does not provide unauthorized access to another person's accounts.