Example: A legal investigator reading filenames can often reconstruct chain-of-custody by combining case IDs, operator initials, and timestamps. Mara tracked Javier to a bus route that morning. She confronted him beneath the same mural. He admitted to filming a whistleblower meeting on April 22, 2022, intending to hand the footage to a reporter. The envelope held not cash but a USB drive; the drive’s label matched the file name.