Compare sent and received evidence-transfer manifests Get the source data and prepare the review Advanced proposed local-snapshot route; helper statically reviewed only and not runtime-tested; full transfer verdict requires independent receiver evidence and acknowledgment WHAT WAS CHECKED Official documentation checked; all routes are proposed and have not been run in a product account. No client data, account access, installs or account writes used. Native column names are distinguished from editorial kit contracts. Missing source evidence blocks completeness claims. BEFORE YOU START - Existing PowerShell 7 on Windows and IT approval to run the bundled helper under the existing script policy. No install, elevation or execution-policy bypass is part of this route. - An approved stable, fully local working snapshot and an existing output folder outside it on the same fixed local drive. Both paths must be absolute drive-letter paths with ordinary, non-reparse-point ancestors. No live/cloud/network/mapped-drive repositories, original forensic media or restricted paths. - The records/IT owner must exclude credential/profile directories and all secret material before selecting the snapshot. The helper uses -Force and hashes every readable regular file, including hidden files; it does not detect or redact secrets. - Records owner supplies scope and identity/custodian/family metadata; hashes establish byte equality only. - The actual authorized transfer scope, sender manifest, recipient identity, receipt/acknowledgment evidence and any approved transformation mapping. - Recipient-side file access and independently generated hashes must be supplied by the authorized recipient/IT owner; this workflow does not contact them or transmit client data. - Firm-approved Excel; optional Copilot entitlement and tenant approval for the exact minimized data. Native Excel analysis can be done manually if Copilot is absent. - Keep raw exports and identifying source pointers in a separate restricted location. The AI workbook contains only approved alias-based tables and visible policy/scope text, never raw client records on another tab. DATA ACQUISITION LIMITS - Sender-side hash and a delivery notification do not prove receiver-side content. A receiver manifest is mandatory for byte comparison. - Renames or transformations need an approved source/destination map. Equal hashes do not prove recipient identity, access or acknowledgment. - Advanced helper route: existing Windows PowerShell 7, approved stable snapshot, IT code review and a safe synthetic test under existing policy are prerequisites. The helper is not a security boundary against concurrent or malicious filesystem changes. No runtime test was performed here. DECLARED INPUT CONTRACT sent.csv: transfer_id, file_id, relative_path, size_bytes, sha256, recipient_id, sent_at, source_ref received.csv: transfer_id, file_id, size_bytes, sha256, received_by, received_at, receipt_ref acknowledgments.csv: transfer_id, recipient_id, acknowledged_at, ack_ref approved_transformations.csv: transfer_id, source_file_id, destination_file_id, approved_by, expected_destination_sha256 STEP 1: Collect real local file sizes and SHA256 hashes Tool: PowerShell 7 on Windows Open: Existing PowerShell 7 session > reviewed Inventory-ApprovedLocalSnapshot.ps1 Access needed: See prerequisites; actual subscription, tenant configuration and permissions are untested. Have IT review the bundled helper and test it on a synthetic fixture under existing script policy before using approved work files. Set absolute snapshot and output paths on the same fixed local drive, with the output directory outside the snapshot. Before running, exclude credential/profile directories and secret material: -Force includes hidden files and there is no automatic secret detection. Run the command below with approved paths. The helper checks path forms, drive type and every directory ancestor, then walks ordinary directories one level at a time without following reparse points, records read/enumeration errors, hashes readable regular files with SHA256, and writes new inventory/issues/control files outside the input. It does not change source bytes. Reads may affect access metadata; this is not forensic acquisition. PASTE THIS PROMPT & '.\Inventory-ApprovedLocalSnapshot.ps1' -Root 'C:\ApprovedSnapshot' -OutputPrefix 'C:\ApprovedAudit\capture-20261015-01' Expected output: Native-cmdlet-derived local_row_id,relative_path,original_name,size_bytes,sha256,observed_last_write_utc,captured_at_utc plus issues/control logs. local_row_id is a run-local row reference, not a persistent document ID. Use it next: Inspect the issue/control logs before mapping the actual sender-side transfer files. Import CSV via Excel Data > From Text/CSV > Transform Data; set IDs, hashes and paths to Text. Do not double-click untrusted CSVs or enable formulas/macros/links. Check: Any skipped/unreadable/changing file is a coverage gap. No claims about deleted files, embedded attachments, alternate streams, cloud versions or access permissions. No repair/delete action. Stop if any path is rejected or changes during capture; do not bypass checks, elevate permissions, install PowerShell or change execution policy as part of this recipe. Documentation limit: Microsoft documents the cmdlets and their options. The bundled composition, error handling and kit mapping are editorial code, not a vendor tool; it has not been runtime-tested here. Source documentation: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-childitem?view=powershell-7.5 https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/get-filehash?view=powershell-7.5 https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/export-csv?view=powershell-7.5 https://support.microsoft.com/en-us/excel/get-started/import-or-export-text-txt-or-csv-files https://learn.microsoft.com/en-us/dotnet/api/system.io.driveinfo.drivetype?view=net-9.0 https://learn.microsoft.com/en-us/dotnet/api/system.io.path.getfullpath?view=net-9.0 STEP 2: Obtain independent receiver evidence Tool: Authorized recipient / records owner Open: Recipient’s approved local received-file snapshot and actual acknowledgment record Access needed: See prerequisites; actual subscription, tenant configuration and permissions are untested. The recipient or authorized IT owner independently runs the same reviewed helper on the actual received files, under their own approved scope, or supplies equivalent already-verified size/SHA256 evidence. Record receipt time, received_by, transfer_id and receipt_ref from the actual transfer system/receipt. Obtain an actual acknowledgment separately. If any is unavailable, stop the complete-transfer verdict and list what is missing. Expected output: Independent receiver manifest and acknowledgment evidence, or explicit acquisition_blocked status. Use it next: No hashes are copied from the sender into the receiver table. Do not initiate external contact or upload as part of this recipe. Check: A successful sender upload or email delivery does not establish received bytes or recipient acknowledgment. Documentation limit: Official hash/enumeration tools support an independent receiver-side capture; the transfer evidence and authorization requirements are editorial controls, not a universal transfer-service export. Source documentation: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/get-filehash?view=powershell-7.5 https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-childitem?view=powershell-7.5 STEP 3: Map the observed records to the starter input Tool: Excel and authorized staff Open: Separate analysis workbook > Home > Format as Table Access needed: See prerequisites; actual subscription, tenant configuration and permissions are untested. Populate sent.csv from the sender snapshot and actual transfer log: transfer_id,file_id,relative_path,size_bytes,sha256,recipient_id,sent_at,source_ref. Populate received.csv independently: transfer_id,file_id,size_bytes,sha256,received_by,received_at,receipt_ref. Populate acknowledgments.csv only from actual recipient acknowledgment. Copy approved_transformations.csv from explicit approval records, including expected_destination_sha256; no inferred transform. Put scope, identity crosswalk, capture times/errors and exclusions into visible Scope. Create named tables for Sent, Received, Acknowledgments and ApprovedTransformations. Put the policy and review scope in visible worksheets or paste them into the next prompt. Expected output: Sent, Received, Acknowledgments and ApprovedTransformations; unacquired receiver evidence blocks completion. Use it next: Check the mapping against each original source before using AI. Check: Aliases and missing policy fields are staff-created; do not relabel a native export as the kit schema. Unknown stays blank/unknown, not false or zero. Documentation limit: Official sources support named product features. Workflow-specific prompts, alias fields, mappings and reviewer rules are editorial adaptations, not native export promises. Source documentation: https://support.microsoft.com/en-us/excel/tutorial-import-data-into-excel-and-create-a-data-model STEP 4: Review the bounded evidence with Copilot Tool: Excel Copilot, optional Open: Approved analysis workbook > Copilot icon at lower right > Chat only Access needed: See prerequisites; actual subscription, tenant configuration and permissions are untested. Use Chat only and submit the prompt. Without Copilot: compare independent sizes/hashes by exact approved keys, then check separate acknowledgment evidence. PASTE THIS PROMPT Validate transfer scope and identity keys, then compare Sent and Received by exact transfer_id/file_id or explicit ApprovedTransformations mapping. Flag missing/extra files, size/hash mismatches, ambiguous mapping and missing/wrong-recipient acknowledgments. For transformations compare the supplied expected_destination_sha256; never invent it. If receiver evidence, complete counts or acknowledgment is absent, return transfer_unverified, not complete. Cite all source/receipt/ack refs. Do not send files, contact recipients or alter data. Expected output: Transfer-integrity exceptions and evidence gaps. Use it next: Copy the draft exception list to the reviewer; retain row references. Check: Check every flagged row and the scope. A fluent answer is not evidence of completeness; no automatic workbook or source-system edits. Documentation limit: Official sources support named product features. Workflow-specific prompts, alias fields, mappings and reviewer rules are editorial adaptations, not native export promises. Source documentation: https://support.microsoft.com/en-us/excel/copilot/get-started-with-copilot-in-excel https://support.microsoft.com/en-us/excel/copilot/frequently-asked-questions-about-copilot-in-excel STEP 5: Approve the review result Tool: Responsible staff reviewer Open: Reviewed local worksheet Access needed: See prerequisites; actual subscription, tenant configuration and permissions are untested. The transfer owner validates independent receiver evidence, every mismatch and actual recipient acknowledgment. Resolve exceptions through the separately authorized transfer process. Expected output: Reviewed integrity finding or transfer-unverified hold. Use it next: Any external message, source change, payment or deletion requires its own authorized process. Check: Do not certify delivery completeness from the sender manifest or an acknowledgment alone. Documentation limit: Editorial human-review gate; linked Excel documentation supports the worksheet used, not legal or accounting conclusions. Source documentation: https://support.microsoft.com/en-us/excel/tutorial-import-data-into-excel-and-create-a-data-model ACCOUNT AND SOURCE CHECKS STILL NEEDED - Actual account access, plan and source-data completeness have not been tested. USING THE FILES IN THIS KIT Use the exact files or source text named in the steps above. Native exports keep their own headers. The kit tables are editorial review worksheets; they are not a claim that a product exports those fields. Some routes use reviewed text directly or require additional original files. Never rename an unreviewed raw export to make it appear mapped. Keep expected-result files separate from inputs. The source account, actual data, prompts and end-to-end workflow were not tested. Any final communication, filing, permission change, payment or publication needs its own authorized human action. This guide performs none.