WEBVTT

00:00:00.165 --> 00:00:01.961
An evidence-preservation receipt can document

00:00:01.961 --> 00:00:05.193
what an agency received and how it was handled.

00:00:05.193 --> 00:00:07.348
It does not prove authenticity, review,

00:00:07.348 --> 00:00:08.785
admissibility, wrongdoing, or obstruction.

00:00:08.785 --> 00:00:09.862
Record six fields.

00:00:09.862 --> 00:00:12.377
First: the exact file name and format.

00:00:12.377 --> 00:00:14.891
Second: the date, time, and intake channel.

00:00:14.891 --> 00:00:16.687
Third: the file’s SHA-256 hash.

00:00:16.687 --> 00:00:19.200
Fourth: the assigned custodian and storage location.

00:00:19.200 --> 00:00:22.074
Fifth: every transfer, access event, or format change.

00:00:22.074 --> 00:00:24.588
Sixth: the retention status and written disposition.

00:00:24.588 --> 00:00:27.461
Preserve the original file separately from working copies.

00:00:27.461 --> 00:00:29.616
A receipt is not an investigation.

00:00:29.616 --> 00:00:32.130
A hash can show whether bytes changed;

00:00:32.130 --> 00:00:35.002
it does not prove who created the record

00:00:35.002 --> 00:00:37.157
or whether its contents are true.

00:00:37.157 --> 00:00:39.672
A missing receipt is a documentation gap,

00:00:39.672 --> 00:00:42.186
not proof of deletion, spoliation, or fraud.

00:00:42.186 --> 00:00:44.341
Read the source-linked record at david-medeiros.com.