A document hash is only part of the evidence.

A hash fingerprints particular bytes. It does not establish who authored a statement, whether the statement is true or whether the whole history has been included.

Several checks, different jobs

• Document hashes identify the specific files and versions.
• Event links help reveal changed content or broken sequence continuity.
• A signed pack binds protected content to a signing key.
• An independently trusted key identifies which signature the reviewer should accept.
• An independent timestamp binds the signed digest to the authority's stated time.

Alterable files. Detectable changes.

A person can edit a downloaded file. The aim is that changed protected content no longer verifies against the original signature and timestamp. Replacing a file, its hash and an embedded key is not enough when the reviewer uses a separately trusted key and timestamp authority chain.

Verification checks integrity and stated provenance. It does not establish legal sufficiency, truth of statements or completeness of events that were never captured.

Open the fictional evidence record and tampering demonstration.