Chain of custody
A record the other side can check without taking our word for it
Imaged, hashed, and publicly timestamped on the day it was recorded.
Most of the time nobody asks how the video was handled. When someone does ask, it is because they intend to keep asking. This is what we can show them.
On the record
The proceeding is captured on independent devices running matched timecode. Nothing is deleted from the original media before its image is verified, and no file is edited on the card. This stays true whenever cards get wiped, including on a multi-day trip.
Media Preservation
Before the media leaves our hands, master cards are forensically imaged to the EnCase Evidence File format (E01). The imaging tool computes a hash of the source and verifies it against the image it just wrote. If those values disagree, the acquisition failed and we know immediately rather than six months later.
Every file recovered from that acquisition is hashed individually with SHA-256, so a delivered file can be matched back to a specific file on a specific card without unpacking the image.
Timestamping
The same day, those hash values are submitted to a public timestamping network anchored to the Bitcoin blockchain. Once a value is anchored, it is fixed in a permanent public record. Anyone can confirm the file existed by that date, and no one, including us, can alter the record afterward.
This matters because it removes us from the question. A certificate from a vendor is only as good as the vendor. A block height is checkable by the other side, by their expert, and by a court, without taking our word for anything.
Production
Working copies are transcoded from the image, never from the original media. Each deliverable is hashed and listed in a manifest alongside the acquisition values, and the manifest is timestamped the same way.
Retention
Files are delivered on a password-protected link that expires after 60 days. We'll make a new one whenever you ask. Master images are retained with their hash manifests and timestamp receipts, so the record can be reproduced and re-verified after the delivery link is long gone.
Authentication package
On request, for any in-person job recorded under Media Preservation, we produce a signed certification identifying the equipment, the imaging process, the hash values, and the block heights at which each timestamp was anchored, executed under penalty of perjury.
Because the timestamps are created on the day of the deposition, ordering the package later loses nothing. The evidentiary work is already done and already anchored. The certification is prepared for your specific matter when you need it, not issued as boilerplate to every job.
How your files are handled
Case files are processed on hardware we own in Hawaiʻi. Nothing goes to an outside AI provider or public API, and your files are never used to train anything. Email runs through Google Workspace and delivery links through pCloud; neither one processes your files.
Only Andrew Graves opens case files. We'll sign an NDA on request, and a Business Associate Agreement when PHI is involved.
Send transcripts by email, or ask for a secure upload link for files over 50 MB. Deliverables come back on password-protected links that expire after 60 days, and we'll make a new one whenever you ask.
Case files are deleted on the schedule you set, or after seven years if you don't set one. E01 masters are kept seven years, and we tell you before anything is deleted.
Andrew reviews every summary, matrix, and chronology before it goes out, and redaction batches are checked for leftover text. Interpreter flags should be confirmed by a qualified interpreter before you rely on them. Your firm still reviews the output before relying on it.