Information Integrity // Truth Forensics 01
Truth Is an Evidence Graph
Desmond Otieno Odhiambo · ClearGlass Intelligence · Burlington, Ontario · 30 September 2026
“Is this video real?” sounds like one question. It is at least four, and a tool that answers it with a single word is guessing at three of them.
When a clip, a photo or a voice note lands in front of a newsroom, an investigator, an insurer or a board, the useful questions are narrower:
- What do these bytes actually contain?
- Where did they come from, and what happened to them on the way?
- Who else observed the same thing, independently?
- What else could explain each odd signal?
Each question has a different kind of answer. The first is measurable. The second is a chain of records. The third is a count, but only if you count the right things. The fourth is a judgement a person has to make. Put them in one graph, and label every edge by how you know it, and “truth” turns from a verdict into something you can inspect.
Ten reposts are one source
The commonest mistake in digital evidence is counting copies as confirmation. A photo shared by forty accounts is still one photo. A clip trimmed and re-encoded is still one recording. Two documents that both quote the same press release are one source with two covers.
So before anything is counted as corroboration, collapse what is not independent:
- Identical bytes. Same SHA-256, same file. One source.
- Declared derivatives. A crop, trim or export of an original belongs with that original.
- Shared upstream. Two items from the same camera, feed or original post.
- Near-duplicates. Two images whose perceptual hashes barely differ are probably the same picture re-saved or edited. That is an inference, and it should be labelled as one.
Only what survives that step, the independence groups, gets counted. In the ClearGlass demonstration case, a photo, its forwarded copy and an edited repost of the same scene collapse into one group. The repost is the item that contradicts the claim, and it turns out to carry a cloned region over the very sign it is being used to read.
Observation, interpretation, conclusion
Every statement about evidence belongs to one of three kinds, and good reports never let them blur:
| Kind | Example | Who can dispute it |
|---|---|---|
| Observation | EXIF DateTime reads 2026:03:15 09:12:44; DateTimeOriginal reads 2026:03:14 21:43:10. | Anyone with the file and a parser. |
| Interpretation | The file was written by software after capture. | Anyone who can offer another explanation (a gallery app, a clock change). |
| Conclusion | Status INCONCLUSIVE pending human review. | The reviewer who signs it, on the record. |
The metadata observation is true about the file. It says nothing certain about the event. Metadata is unsigned and trivially rewritten, so every metadata-derived “fact” about time, place or device is an inference about the world, however precise it looks.
Draw the graph, label the edges
An evidence graph has items, sources, devices, places, times, subjects, events and the claim under test. The discipline is in the edges:
- Factual edges are things your own process did and can show: acquired this file, hashed it, recorded that it was derived from that one, ran this analyzer.
- Inferential edges are everything else: this file was captured by that camera (says EXIF), this item supports the claim (says a comparison rule), this sign reads Dock 4 (says an analyst).
Draw them differently. In the ClearGlass Truth Forensics console, factual edges are solid and inferences are dashed, and there is no setting that turns a dashed line solid.
What “supported” should mean
A claim such as “Video A shows Forklift FL-3 at Dock 2 at 21:43” breaks into propositions: source, subject, time, place, event, plus two implicit ones, provenance and independent corroboration. Each proposition gets its own verdict from explicit rules:
- No independent group addresses it: UNVERIFIED.
- One group agrees: PARTIALLY SUPPORTED. One source is never more than that.
- Two or more agree and none conflict: SUPPORTED.
- Groups agree and conflict: INCONCLUSIVE, flagged as a corroboration conflict.
- Only conflicts: CONTRADICTED.
The claim as a whole is a conjunction. One contradicted proposition contradicts it. Confidence follows the same logic: HIGH needs three independent groups and no open anomalies on the items involved.
What this changes on Monday
- Hash at intake. Before anyone opens, trims or forwards a file, record its SHA-256 and who received it.
- Group before you count. Write down why items are or are not independent.
- Record inferences as inferences. An analyst reading a sign is evidence, but it is not the same kind of evidence as a hash.
- Make the decision a record. The final status is analysis plus a named reviewer's decision, appended and never edited.
Try it on synthetic data in the Truth Forensics console, or read the companion pieces: Why Deepfake Detection Needs Chain of Custody and When AI Cannot Determine the Truth.