Reconstructing a Day From Fragments
Assembling a day from systems that were never meant to describe one, labelling the result honestly, and the limits of what a reconstruction can carry.
A reconstruction is a document the organisation made, and it has to be labelled as one. Assembling a day from door logs, transactions, messages and a rota produces something that looks like a record and is not: it is an interpretation, built after the fact, by somebody with a view.
The practical lesson in “Reconstructing a Day From Fragments” is that visibility is not certainty. For teams researching employee monitoring software with screenshots, read the supporting product page can add time and project context to the operational record, provided the purpose is explained, access is restricted and any material inference is checked through conversation and proportionate human review.
That does not make it worthless. Labelled honestly, with its method and its assumptions stated, it is legitimate and frequently the only thing available. Presented as a record, it misrepresents what the organisation knows.
A broader reference for the question in “Reconstructing a Day From Fragments” is the OAIC online privacy guidance. Read it alongside the local facts so that an external framework informs the assessment without replacing case-specific judgement.
What a reconstruction must carry
- A statement that it is a reconstruction, at the top.
- The sources used, each named, with the date each was extracted.
- The assumptions made, listed.
- The gaps, marked as gaps rather than filled.
- Who built it, and when.
- What was looked for and not found.
The last is the one that distinguishes an honest reconstruction from a constructed one. A document that lists the systems checked which produced nothing is describing an effort; one that lists only the productive sources is describing a selection.
The sources, in the order they are worth checking
Anything with a continuous record first: telematics, access control, transaction systems. Then anything with a timestamp that can be tied to an action. Then anything self-reported. Then recollection.
The order matters because the early sources constrain the later ones. A vehicle track establishes a frame that a recollection then either fits or does not.
Assumptions, written as assumptions
A reconstruction rests on assumptions and the useful ones are small and explicit: that the person drove the van, that the badge was theirs, that the clock offsets measured today applied then.
Each of those might be wrong, each is reasonable, and listing them lets somebody else test the conclusion rather than having to accept it.
What a reconstruction cannot carry
Precision it does not have. A reconstruction that concludes somebody was absent for 47 minutes, from sources accurate to five minutes, has manufactured precision.
Round the conclusion to the accuracy of the inputs and say what that accuracy is. "Between roughly half an hour and an hour" is both more honest and, oddly, more persuasive.
Putting the reconstruction to them
A reconstruction should go to the employee in full, with its method, and they should be invited to correct it.
That is where most of them improve. People remember the ordinary detail that explains a gap — a delivery, a call, a conversation — and the reconstruction gets better rather than weaker for having been corrected.
Reconstructing in both directions
Where the person gives an account, reconstruct against it as well: what would exist if their account were right, and is it there?
That symmetry is what makes the exercise an investigation rather than a case-building effort, and it is visible in the file either way. A reconstruction that only ever tested one hypothesis is recognisable.
When nothing is left
Sometimes the systems hold nothing: the window has passed, the logs were purged, the work produces no records.
The honest output is a short note saying so. An employer that says "we cannot establish what happened" has described its position accurately, which is a stronger place to be than a reconstruction built from almost nothing and presented with confidence.
How long it takes
A reconstruction of one day from four systems takes between half a day and two days depending on how accessible the data is, and the estimate is worth making before starting.
That matters because the cost frequently exceeds whatever is in dispute, and knowing the figure in advance is what allows a proportionate decision — including the decision not to reconstruct at all and to handle the matter another way.
The second opinion
Before relying on a reconstruction, give it to somebody uninvolved with the sources and ask what it shows.
They will read the gaps differently and question at least one assumption. Fifteen minutes, and it is the only review most of these documents ever get before they are relied on.
Reconstructions that exonerate
The same method applied to an account that turns out to be true produces a document worth keeping and circulating internally.
It is also the strongest evidence that the method is being applied honestly, which matters for every subsequent use of it.
Keeping it with its workings
The reconstruction, every extract behind it, the method note, the assumptions and the correspondence with the person.
That package is what makes the document mean anything later. A reconstruction that survives in the file without its sources is an assertion with a date on it, which is exactly what it was built to avoid being.