Evidence-to-Finding Flow
A visual summary of The Zemi Method, Version 1.1.
Authoritative text: This page is an explanatory visual summary. The authoritative method remains The Zemi Method, Version 1.1 and its archival record at Zenodo.
Input: Proposed Claim / QuestionThe matter presented for possible examination. It is not yet a framed evidentiary question.
↓
↓
Six-phase lifecycle begins: 1. FrameConvert the proposed matter into a bounded evidentiary question. State assumptions, competing explanations, what would support each explanation, and what would break it.
↓
2. PreservePreserve evidence, source identity, condition, custody boundaries, transfer integrity, automation records, and AI contribution records where material.
↓
3. CorroborateTest material claims against independent sources and test whether each material extraction is complete and faithful for the question asked.
SupportedIndependent evidence supports the claim without sharing the same failure mode.
ConflictSources contradict each other; the conflict becomes evidence to investigate.
Unsupported / UnavailableCorroboration, access, or completeness is absent; the limitation is stated and affects classification.
↓
4. AnalyzeInterpret evidence, prior work, tool-derived outputs, layered infrastructure, standards mappings, and derivative presentations without treating summaries as source evidence.
Automation may assist retrieval, correlation, summarization, pattern proposal, and drafting. Human judgment only beyond this point.
5. AdjudicateA person sets the conclusion, states the support basis for known findings, marks undetermined findings as pending or exhausted, and keeps assumptions visible.
KnownSupported by evidence within stated scope and limits, with support basis stated.
AssumedRelied on for a stated, limited purpose without being directly established.
UndeterminedUnresolved on available evidence; marked pending if being pursued or exhausted if proportionate inquiry is complete.
↓
6. ReportState findings, authority, scope, mode, evidence, reasoning, limits, contrary evidence, assumptions, AI role, automation contribution, and release authority.
↓
Defensibility CheckIf the finding cannot be traced, bounded, reproduced from preserved evidence, explained with its limits, and released under identified authority, it returns to the phase where the gap opened.
↓
Finding Released or ReturnedOnly findings that pass the standing check leave the practice.
Version 1.1 Controls Added to the Flow
These controls are not separate lifecycle phases. They are checks that must be carried through Phase 0 and the six-phase lifecycle when material to the engagement.
Authority and disclosureAuthority to work and authority to release evidence, findings, or reports are identified separately.
Source completenessMaterial queries, exports, parses, and summaries are checked for completeness and faithful extraction.
Transfer or retained custodyTransfers record packaging, encryption, delivery, and receipt; retained-custody work records the boundary that material never left.
Prior work as source materialPrior reports, examiner findings, and investigative summaries are tested against underlying evidence before reliance.
Narrowing is not attributionSuspect, account, device, system, or source narrowing states the remaining candidate pool and what is needed for stronger attribution.
Layered responsibilityTechnical delivery, account ownership, operational control, legal responsibility, and financial benefit are not collapsed into one finding.
Standards mappingCompliance, alignment, or deviation findings identify the standard, version, requirement, applicability basis, evidence, and interpretive limit.
Tool-derived outputsMeasurements, enhancements, comparisons, calculations, and transformations state processing basis, validation checks, and uncertainty limits.
Derivative presentationsExcerpts, compilations, timelines, transcripts, edited videos, and visualizations identify source links, selection criteria, excluded context, and non-substitution limits.
Investigation and Assurance
The same lifecycle applies in two directions. In investigation, the method tests claims about what happened inside a system. In assurance, the method tests claims about the system itself: what it does, where it fails, which controls operate, and who remains accountable.
InvestigationClaim about an event → evidence tested → finding about what happened.
AI AssuranceClaim about a system → behavior, controls, outputs, and role tested → finding about whether the claim can be trusted.
Plain-Language Reading
The method prevents a jump from “a system says this happened” to “this happened.” Version 1.1 adds an earlier question: whether the examiner is authorized to ask, answer, and release the finding. It also requires the examiner to show that material source extractions were complete enough for the question, that prior summaries were not inherited untested, and that tool or AI outputs did not become conclusions.
Claim-centeredTraditional forensic methods protect and examine evidence. Zemi governs the reasoning from evidence to finding.
AI boundaryAutomation can help retrieve, correlate, summarize, propose, and draft. It does not adjudicate, conclude, or sign off. When AI is material, its role is classified and reported.