Linking a sock puppet to a real operator via recovery metadata

Investigation log

1. Step 01 — Surface

   Target presented clean identifiers — no breaches on primary email.

2. Step 02 — Alias reuse

   Same handle on archived gaming forum (2019) with different email domain.

3. Step 03 — Recovery

   Microsoft partial hint on alias email matched pattern from forum registration era.

4. Step 04 — Validate

   Cross-referenced snowflake ID creation window with forum last-seen — consistent.

This case is synthetic and declassified for training purposes. Methodology reflects how Inquire analysts work; identifiers and locations are fictional.