{
  "Metadata": {
    "SchemaVersion": 1,
    "ToolVersion": "0.2.8",
    "Mode": "Demo",
    "Status": "Complete",
    "StartedUtc": "2026-10-13T16:59:50.0000000Z",
    "CompletedUtc": "2026-10-13T17:00:00.0000000Z",
    "DomainName": "demo.example",
    "DomainSid": "S-1-5-21-111111111-222222222-333333333",
    "ForestRootDomain": "demo.example",
    "Server": "dc01.demo.example (synthetic)",
    "SearchBase": "DC=demo,DC=example",
    "InactiveDays": 90,
    "RequestedGraceDays": 14,
    "EffectiveGraceDays": 14,
    "TimestampSyncDays": 14,
    "TimestampSignalAvailable": true,
    "CandidateCutoffUtc": "2026-07-01T17:00:00.0000000Z",
    "Queries": [
      {
        "Query": "Get-ADDomain (synthetic)",
        "Status": "Collected",
        "Count": 1
      },
      {
        "Query": "Get-ADForest (synthetic)",
        "Status": "Collected",
        "Count": 1
      },
      {
        "Query": "Domain timestamp interval (synthetic)",
        "Status": "Collected",
        "Count": 1
      },
      {
        "Query": "Get-ADUser (synthetic)",
        "Status": "Collected",
        "Count": 8
      },
      {
        "Query": "Get-ADGroup (synthetic)",
        "Status": "Collected",
        "Count": 13
      }
    ],
    "Scope": "One domain; AD user objects and group membership relationships only. Not effective authorization, a forest audit, or historical evidence."
  },
  "FileHashes": [
    {
      "File": "accounts.csv",
      "Bytes": 4206,
      "SHA256": "8A24EAD79746205C9627C1D2216F9AE0DAC6FAF4BBE05CB852768BCAAE3AC13B"
    },
    {
      "File": "collection-issues.csv",
      "Bytes": 39,
      "SHA256": "7C33D723245FBEA8C4284DB5E979E0C522D8EC080469744F32C00D78767AE761"
    },
    {
      "File": "inactivity-candidates.csv",
      "Bytes": 1893,
      "SHA256": "1906CB3E1C0F82C7AFD0AA8E0C32160BBD51F5FBDE66F4FD7AFA41E6BF28806B"
    },
    {
      "File": "memberships.csv",
      "Bytes": 3385,
      "SHA256": "1FF00E997583334356DC1BDDCAA8EA1A540D31D84D490F587624764AAD31345B"
    },
    {
      "File": "privileged-memberships.csv",
      "Bytes": 781,
      "SHA256": "45BF55E119BE6EE3CF321D2A7309F57304068D242E868E73F70CA411E046B055"
    },
    {
      "File": "report.html",
      "Bytes": 115464,
      "SHA256": "F7687BB220CD5C4340E4E001C41C83C179708E8041B49065A81370F882345424"
    },
    {
      "File": "reviewer-worksheet.csv",
      "Bytes": 1640,
      "SHA256": "01A632BADC20ED4B92D86BE40310FAB469E8159FEC70FAAFD8F9521AE43968A9"
    },
    {
      "File": "selected-groups.csv",
      "Bytes": 1063,
      "SHA256": "517DCEDEC94596BCA503FA10079D8CD72191FA4F86748801028D8DA43B4BACE4"
    },
    {
      "File": "snapshot.json",
      "Bytes": 23177,
      "SHA256": "7D2853CDE214C094A4F164E9FE43E3882C408D76196C3960B045E8E626E4F64D"
    },
    {
      "File": "unexpanded-members.csv",
      "Bytes": 43,
      "SHA256": "B1B91C5C3A976DA2EABD716EC5B355155D306A64A047152944C645F6FC0C94B2"
    }
  ],
  "Notes": "Hashes detect changes relative to this manifest; the manifest is not digitally signed. Keep original evidence separate from the completed worksheet. CSV formula-like text is prefixed with an apostrophe; snapshot.json retains original values."
}