Map exact duplicate documents without deleting evidence
Get the source data and prepare the review

Advanced proposed local-snapshot route; helper statically reviewed only and not runtime-tested

WHAT WAS CHECKED
Official documentation checked; all routes are proposed and have not been run in a product account. No client data, account access, installs or account writes used. Native column names are distinguished from editorial kit contracts. Missing source evidence blocks completeness claims.

BEFORE YOU START
- Existing PowerShell 7 on Windows and IT approval to run the bundled helper under the existing script policy. No install, elevation or execution-policy bypass is part of this route.
- An approved stable, fully local working snapshot and an existing output folder outside it on the same fixed local drive. Both paths must be absolute drive-letter paths with ordinary, non-reparse-point ancestors. No live/cloud/network/mapped-drive repositories, original forensic media or restricted paths.
- The records/IT owner must exclude credential/profile directories and all secret material before selecting the snapshot. The helper uses -Force and hashes every readable regular file, including hidden files; it does not detect or redact secrets.
- Records owner supplies scope and identity/custodian/family metadata; hashes establish byte equality only.
- Actual receipt/batch log, custodian aliases and document-family metadata supplied by the records owner.
- Firm-approved Excel; optional Copilot entitlement and tenant approval for the exact minimized data. Native Excel analysis can be done manually if Copilot is absent.
- Keep raw exports and identifying source pointers in a separate restricted location. The AI workbook contains only approved alias-based tables and visible policy/scope text, never raw client records on another tab.

DATA ACQUISITION LIMITS
- SHA256 groups byte-identical files only. Different encodings, metadata or OCR layers can change hashes even when pages look the same.
- Equal file bytes do not justify deletion: custodians, attachments, families, production history and legal holds remain distinct.
- Advanced helper route: existing Windows PowerShell 7, approved stable snapshot, IT code review and a safe synthetic test under existing policy are prerequisites. The helper is not a security boundary against concurrent or malicious filesystem changes. No runtime test was performed here.

DECLARED INPUT CONTRACT
file-manifest.csv: file_id, source_batch, original_path, original_name, size_bytes, sha256, custodian_alias, family_id, received_at
scope.txt

STEP 1: Collect real local file sizes and SHA256 hashes
Tool: PowerShell 7 on Windows
Open: Existing PowerShell 7 session > reviewed Inventory-ApprovedLocalSnapshot.ps1
Access needed: See prerequisites; actual subscription, tenant configuration and permissions are untested.

Have IT review the bundled helper and test it on a synthetic fixture under existing script policy before using approved work files. Set absolute snapshot and output paths on the same fixed local drive, with the output directory outside the snapshot. Before running, exclude credential/profile directories and secret material: -Force includes hidden files and there is no automatic secret detection. Run the command below with approved paths. The helper checks path forms, drive type and every directory ancestor, then walks ordinary directories one level at a time without following reparse points, records read/enumeration errors, hashes readable regular files with SHA256, and writes new inventory/issues/control files outside the input. It does not change source bytes. Reads may affect access metadata; this is not forensic acquisition.

PASTE THIS PROMPT
& '.\Inventory-ApprovedLocalSnapshot.ps1' -Root 'C:\ApprovedSnapshot' -OutputPrefix 'C:\ApprovedAudit\capture-20261015-01'

Expected output: Native-cmdlet-derived local_row_id,relative_path,original_name,size_bytes,sha256,observed_last_write_utc,captured_at_utc plus issues/control logs. local_row_id is a run-local row reference, not a persistent document ID.
Use it next: Inspect the issue/control logs before mapping the received-file manifest. Import CSV via Excel Data > From Text/CSV > Transform Data; set IDs, hashes and paths to Text. Do not double-click untrusted CSVs or enable formulas/macros/links.
Check: Any skipped/unreadable/changing file is a coverage gap. No claims about deleted files, embedded attachments, alternate streams, cloud versions or access permissions. No repair/delete action. Stop if any path is rejected or changes during capture; do not bypass checks, elevate permissions, install PowerShell or change execution policy as part of this recipe.
Documentation limit: Microsoft documents the cmdlets and their options. The bundled composition, error handling and kit mapping are editorial code, not a vendor tool; it has not been runtime-tested here.
Source documentation:
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-childitem?view=powershell-7.5
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/get-filehash?view=powershell-7.5
https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/export-csv?view=powershell-7.5
https://support.microsoft.com/en-us/excel/get-started/import-or-export-text-txt-or-csv-files
https://learn.microsoft.com/en-us/dotnet/api/system.io.driveinfo.drivetype?view=net-9.0
https://learn.microsoft.com/en-us/dotnet/api/system.io.path.getfullpath?view=net-9.0

STEP 2: Map the observed records to the starter input
Tool: Excel and authorized staff
Open: Separate analysis workbook > Home > Format as Table
Access needed: See prerequisites; actual subscription, tenant configuration and permissions are untested.

Populate file-manifest.csv: assign file_id using a persistent audit crosswalk; map original_path,original_name,size_bytes,sha256 from observed files; obtain source_batch,custodian_alias,family_id,received_at from the actual receipt log. File creation/last-write timestamps are not receipt times. If the snapshot changed paths, preserve the documented original-path crosswalk rather than guessing. Put scope.txt and all errors/exclusions into Scope; keep raw identifying paths separate from the approved AI version. Create named tables for FileManifest. Put the policy and review scope in visible worksheets or paste them into the next prompt.

Expected output: FileManifest with true byte hashes and separately sourced provenance.
Use it next: Check the mapping against each original source before using AI.
Check: Aliases and missing policy fields are staff-created; do not relabel a native export as the kit schema. Unknown stays blank/unknown, not false or zero.
Documentation limit: Official sources support named product features. Workflow-specific prompts, alias fields, mappings and reviewer rules are editorial adaptations, not native export promises.
Source documentation:
https://support.microsoft.com/en-us/excel/tutorial-import-data-into-excel-and-create-a-data-model

STEP 3: Review the bounded evidence with Copilot
Tool: Excel Copilot, optional
Open: Approved analysis workbook > Copilot icon at lower right > Chat only
Access needed: See prerequisites; actual subscription, tenant configuration and permissions are untested.

Use Chat only and submit the prompt. Without Copilot: sort/group exact SHA256+size, retaining every source row and its provenance.

PASTE THIS PROMPT
Group FileManifest by exact valid SHA256 and size_bytes within Scope. Return each byte-identical group with every file_id, batch, custodian, family and receipt reference retained. Flag missing hashes/provenance or inconsistent size/hash combinations. Do not infer duplicates from names, merge family records, choose a canonical copy, classify relevance or recommend deletion. Different hashes are not proof of different substantive content. Cite rows.

Expected output: Exact-byte duplicate map with provenance and uncertainty preserved.
Use it next: Copy the draft exception list to the reviewer; retain row references.
Check: Check every flagged row and the scope. A fluent answer is not evidence of completeness; no automatic workbook or source-system edits.
Documentation limit: Official sources support named product features. Workflow-specific prompts, alias fields, mappings and reviewer rules are editorial adaptations, not native export promises.
Source documentation:
https://support.microsoft.com/en-us/excel/copilot/get-started-with-copilot-in-excel
https://support.microsoft.com/en-us/excel/copilot/frequently-asked-questions-about-copilot-in-excel

STEP 4: Approve the review result
Tool: Responsible staff reviewer
Open: Reviewed local worksheet
Access needed: See prerequisites; actual subscription, tenant configuration and permissions are untested.

The records owner spot-checks byte-equal groups, confirms hashes/coverage and preserves every original and family association. Use the map for review organization only.

Expected output: Reviewed duplicate map; no files deleted or altered.
Use it next: Any external message, source change, payment or deletion requires its own authorized process.
Check: Hash equality is technical evidence about bytes, not a legal retention, privilege or relevance decision.
Documentation limit: Editorial human-review gate; linked Excel documentation supports the worksheet used, not legal or accounting conclusions.
Source documentation:
https://support.microsoft.com/en-us/excel/tutorial-import-data-into-excel-and-create-a-data-model

ACCOUNT AND SOURCE CHECKS STILL NEEDED
- Actual account access, plan and source-data completeness have not been tested.

USING THE FILES IN THIS KIT
Use the exact files or source text named in the steps above. Native exports keep their own headers. The kit tables are editorial review worksheets; they are not a claim that a product exports those fields. Some routes use reviewed text directly or require additional original files. Never rename an unreviewed raw export to make it appear mapped. Keep expected-result files separate from inputs.

The source account, actual data, prompts and end-to-end workflow were not tested. Any final communication, filing, permission change, payment or publication needs its own authorized human action. This guide performs none.
