An Alibi Is Not a Sentence: Build a Timeline That Can Be Tested

“I was at home all evening” is not yet an alibi. It is a claim about time, place and action. A strong mystery turns that claim into a timeline that readers can test.

The point is not to drown a story in forensic detail. It is to separate what someone remembers, what a device recorded, what another person observed and what the writer merely assumes. Once those layers are visible, a mystery can be surprising without becoming arbitrary.

This article is a writing and media-literacy framework, not guidance for investigating real people. Real criminal investigations require lawful authority, trained practitioners, disclosure duties and safeguards that a novelist’s spreadsheet cannot reproduce.

An alibi is a model, not a sentence

An alibi usually arrives as compressed language: “I left at nine”, “she called me from the station”, “the camera proves he was there”. Each sentence hides several smaller propositions. Which clock showed nine? Who saw the departure? Was the call live or recorded? Does the camera time match the actual time? How long would the journey normally take, and what could have changed it?

Official UK policing guidance describes the purpose of investigative interviewing as obtaining accurate and reliable accounts from victims, witnesses and suspects. That wording is useful for writers because it resists a common dramatic mistake: treating confidence as accuracy. A vivid account may still contain an honest timing error. A hesitant account may still be correct.

The writer’s first job is therefore decomposition. Turn the alibi into individual events, attach a source to each event and state how precise that source really is.

Build four parallel timelines

1. The claimed timeline

This is what each character says happened, in their own sequence and language. Preserve uncertainty. “Around nine” should not become 9:00 p.m. simply because a spreadsheet prefers exact values. Record whether the time was recalled independently, inferred from a routine or reconstructed after the character saw other evidence.

2. The observed timeline

This contains what other people report seeing or hearing. Separate direct observation from interpretation. “I saw Maya enter the building” is different from “Maya went home”. The first describes an observed movement; the second adds an unverified conclusion about where she stayed.

3. The recorded timeline

This contains CCTV, access logs, messages, photographs, payment records, transport data and device events. The College of Policing notes that CCTV may help establish a timeline and verify an account. “May help” is the right standard: an image can show a person at one location at one moment, but it does not automatically prove what happened before, afterwards or outside the frame.

4. The physical-possibility timeline

This tests travel, access and duration. Could the character cover the distance? Did the building require a key? Would the last train, road closure or lift outage alter the route? The result should be a range, not a magical stopwatch. A journey that takes 18 minutes in perfect conditions may take 30 when waiting, parking or security checks are included.

Do not let one clock rule them all

Mysteries often act as though every clock in the story shares one exact time. Real digital systems may record local time, Coordinated Universal Time, server time or a device time set incorrectly by a user. The US National Institute of Standards and Technology has noted in its cloud-forensics work that systems do not all use UTC and that a local timestamp needs its time-zone offset collected.

A timestamp is therefore data plus context. For every important recorded time, the writer should know:

• which device or service created it;
• which time standard and time zone it used;
• whether the clock was known to be accurate;
• whether the value records creation, transmission, receipt, modification or display;
• and whether anyone could have changed the device, file or account.

This does not mean every timestamp is suspicious. It means its meaning must be established rather than assumed.

Metadata is a clue, not a verdict

Metadata describes other data. A photograph may contain a creation time, device information or location fields; a document may record an author or modification date. The UK Government’s independent review of disclosure in the digital age gives author, modified date and file size as basic examples.

For a mystery writer, metadata can create an elegant contradiction: a file said to have been created on Tuesday was exported on Thursday; a message displayed at 8:10 was received by a server at 8:12; a photograph’s embedded time differs from the station clock visible in the image.

But metadata should not become magic. Values may be missing, copied, altered by software, changed by time-zone conversion or inherited during export. NIST’s review of digital investigation describes the work as hypothesis-driven: investigators search for artefacts such as files and logged events, then assess them within a wider process. One artefact should rarely carry the entire plot.

Preserve provenance inside the story

Evidence is not just information; it also has a history. Who collected the recording? Was it the original or a copy? Was a clip trimmed? Did the investigator receive the whole conversation or only a screenshot? The current Forensic Science Regulator’s statutory code requires procedures for handling, protecting and storing exhibits while recording chain of custody.

Writers can translate that principle into a simple provenance note for each decisive clue: source, collector, acquisition time, original location, transformations and current custodian. A screenshot sent through a messaging app is not equivalent to the original device record. A re-encoded video may still be useful, but the story should not quietly grant it qualities it no longer has.

Provenance can also produce plot. The clue may be authentic but incomplete. The detective may discover that the “missing” minutes were created during export rather than by the suspect. A character may be truthful about the image but wrong about when it reached their phone.

Contradiction is not guilt

This is the ethical hinge of the timeline. If a witness says 8:00 and a log says 8:12, the difference proves inconsistency—not why it exists. Possible explanations include an imprecise memory, a slow clock, delayed synchronisation, a misunderstood question, deliberate deception or an error elsewhere in the evidence.

A fair mystery generates alternatives before selecting one. For every contradiction, write at least three explanations: innocent, ambiguous and incriminating. Then ask what new observation would distinguish them. This prevents the investigator—and the reader—from treating the first satisfying narrative as the only possible one.

It also creates better suspense. A clue becomes more interesting when it changes the question rather than instantly naming the culprit.

A fictional worked example

Invented scenario: Leila says she left a gallery at 8:45 p.m., walked to the station and called her sister from the platform at nine. A door log records her badge exit at 8:47. Street CCTV shows someone in a similar coat two minutes later. Her sister’s phone displays a call at 9:03. The train timetable suggests a service at 9:05.

A weak story declares the alibi proven. A stronger timeline asks what each source establishes. The badge shows that Leila’s credential was used, not necessarily who used it. The camera supports a route but may not identify a face. The call record shows communication between accounts or devices, not automatically where either person stood. The timetable shows a planned service, not that it ran on time or that Leila boarded it.

Now add one fair clue: the station clock in the CCTV image is four minutes slow, and this fact appears earlier when another character misses a train. The final deduction can surprise readers because the timing changes, yet the story did not hide the rule that changed it.

Use an uncertainty budget

Assign each event a precision level. An automated access log may be recorded to the second but still have identity uncertainty. A witness may identify the person confidently but estimate the time only to the nearest quarter-hour. A journey planner may calculate a precise duration while ignoring the queue at security.

Do not average those differences into one false number. Keep separate fields for time precision, identity confidence, source independence and provenance. Two sources that copied the same original report are not independent confirmation.

The fair-play timeline test

• Source: Can the reader tell where each important time came from?
• Meaning: Does the story distinguish what the source records from what characters infer?
• Precision: Are approximate memories kept approximate?
• Clock: Are time zones, drift and device settings considered when they matter?
• Provenance: Is the original material distinguishable from copies, clips and screenshots?
• Alternatives: Does a contradiction have more than one possible explanation?
• Disclosure: Has the story shown the rule or clue that makes the final timing deduction possible?

A good alibi does not merely clear or condemn a character. It reveals the structure of the story’s evidence. When readers can see the clocks, sources, gaps and assumptions, they are not just waiting for the detective’s answer. They are solving the mystery alongside them.

---

Featured image: original conceptual AI illustration created for this article. It does not depict a real investigation, person or case.