1
00:00:00,165 --> 00:00:01,961
An evidence-preservation receipt can document

2
00:00:01,961 --> 00:00:05,193
what an agency received and how it was handled.

3
00:00:05,193 --> 00:00:07,348
It does not prove authenticity, review,

4
00:00:07,348 --> 00:00:08,785
admissibility, wrongdoing, or obstruction.

5
00:00:08,785 --> 00:00:09,862
Record six fields.

6
00:00:09,862 --> 00:00:12,377
First: the exact file name and format.

7
00:00:12,377 --> 00:00:14,891
Second: the date, time, and intake channel.

8
00:00:14,891 --> 00:00:16,687
Third: the file’s SHA-256 hash.

9
00:00:16,687 --> 00:00:19,200
Fourth: the assigned custodian and storage location.

10
00:00:19,200 --> 00:00:22,074
Fifth: every transfer, access event, or format change.

11
00:00:22,074 --> 00:00:24,588
Sixth: the retention status and written disposition.

12
00:00:24,588 --> 00:00:27,461
Preserve the original file separately from working copies.

13
00:00:27,461 --> 00:00:29,616
A receipt is not an investigation.

14
00:00:29,616 --> 00:00:32,130
A hash can show whether bytes changed;

15
00:00:32,130 --> 00:00:35,002
it does not prove who created the record

16
00:00:35,002 --> 00:00:37,157
or whether its contents are true.

17
00:00:37,157 --> 00:00:39,672
A missing receipt is a documentation gap,

18
00:00:39,672 --> 00:00:42,186
not proof of deletion, spoliation, or fraud.

19
00:00:42,186 --> 00:00:44,341
Read the source-linked record at david-medeiros.com.