What the evidence can show
Start with documentation that explains what a person is expected to do after losing access. This might be a help page, an account-settings screen, or an official message received during a recovery attempt. Note where the information appeared, when it was checked, and whether it applies to the relevant account type or region. A search result snippet or an old screenshot is weaker evidence because it may omit conditions or reflect an outdated process.
Separate the existence of a route from its practical details. A page may mention a recovery form without stating what information it requests, how identity is checked, or what happens next. Record those gaps rather than filling them with assumptions. The table offers a way to assess evidence without treating a possible method as a confirmed feature.
| Evidence item | What to verify | What it cannot establish alone |
|---|---|---|
| Help documentation | Scope, date, stated steps and exceptions | That every account can use the route |
| Recovery screen | Prompts, available choices and displayed notices | How a request will be resolved |
| Confirmation message | Sender authenticity, action and timing | That the account is fully secure afterward |
For example, a hypothetical help page might say that a person can request a reset by email. That supports reporting an email-based reset route, but not claiming that email is the only option or that every request succeeds. A hypothetical screen showing a second verification step would support noting that prompt, not guessing what evidence will satisfy it.
How to check the details
Compare the written instructions with the actual wording shown in a normal, authorized account session, if one is available. Do not submit repeated requests merely to test a system, and do not try to access another person’s account. If the screen and documentation differ, record both and the date; a discrepancy is itself relevant evidence. Avoid storing sensitive screenshots or copying personal data into notes.
- Identify the route. Record whether the evidence describes a password reset, contact-detail update, support request, or another process. Use the site’s own terminology where possible.
- Check the trigger. Note whether instructions address a forgotten password, loss of access to an email account, a locked account, or a different circumstance. Do not treat distinct problems as interchangeable.
- Check confirmation. Look for stated steps such as a code, link, identity check, or notice confirming a change. Record what the evidence says, not what seems likely to happen.
- Check timing and limits. Capture any stated expiry, waiting period, attempt limit, support hours, or condition. If none is documented, say “not stated” rather than inferring that no limit exists.
- Protect secrets. Never include passwords, one-time codes, recovery codes, or full identity documents in a review. Keep any recovery codes private and store them separately from a password; describe safeguards without exposing the values.
A hypothetical example: instructions might say a reset link expires after a stated period. The review can report that condition and its source. Unless the process was independently observed, it should not claim that delivery is immediate or that the link always works. Confirmation of an email or phone change should also be distinguished from confirmation that all sessions, devices, and security settings have been reviewed.
Recording a useful conclusion
Write a brief conclusion that separates confirmed facts, observations, and unknowns. For each fact, identify its source and check date. Say whether a step was described in documentation or seen on a screen; those are different kinds of evidence. If access was not tested, state that plainly. Avoid turning one person’s hypothetical path into a universal account of the process.
A balanced note might say: “The help page reviewed on [date] describes a reset request by email. It does not specify whether alternative verification is available or how long review may take.” Bracketed details are placeholders, not claims. This format is more useful than a broad statement such as “recovery is easy,” which has no defined measure and may not apply to other circumstances.
Finally, keep recovery separate from account restrictions or eligibility controls. A recovery process concerns access and identity; it should not be presented as a way to remove a self-exclusion or other protective restriction. Do not publish private support correspondence without removing personal information. A careful review stays within the evidence, protects account secrets, and makes uncertainty visible.