Signed Hash Reports: Proving Who Issued a Deposition Record

Generative AI has made video easier to fake or alter, so counsel increasingly need to show that a deposition recording has not changed. SHA-256 hashing shows whether a file is identical to the one we preserved. On its own, it does not show who recorded those hash values or when. A digitally signed hash report answers both questions.

What the report contains

When the authentication package is ordered, we compile the SHA-256 values of each E01 forensic image, every file it contains, and each delivered MP4 into a single PDF report. We then digitally sign the PDF and anchor it with OpenTimestamps.

How the signing key was made

Our signing keys are generated in a Tails virtual machine with no network access, then stored on a YubiKey hardware security key. Tails keeps nothing after it shuts down, so the environment the key was made in no longer exists. The YubiKey is designed so the private key cannot be extracted or copied from the device, so only the holder of that key can produce our signature.

How signing works

Signing does not encrypt the report; anyone can open and read it. The PDF software calculates a fingerprint of the document, and the YubiKey signs that fingerprint with our private key. The signature and our signing certificate, which identifies us as the issuer, are embedded in the PDF.

Verifying the report

Open the report in any PDF reader that supports digital signatures. Because our certificate is self-issued, the reader may show the signer as unknown. To confirm it's ours, match the certificate to the one published at /keys. A valid signature means the report has not changed since it was signed and that it was signed with our key. Any change to the report after signing, even a single character, invalidates the signature.

To check a delivered video, calculate its SHA-256 value with the tools built into Windows (Get-FileHash in PowerShell) or macOS (shasum -a 256 in Terminal) and compare it with the value in the report. If they match, the file is unchanged.

Proving when: OpenTimestamps

A signature shows who issued the report, but not when. OpenTimestamps records the report's fingerprint in the Bitcoin blockchain, a public ledger no single party controls. The proof file delivered with the report shows the report existed no later than that time, without relying on our word.

Non-repudiation

Security engineers call this non-repudiation: because only our hardware key can produce our signature, we cannot later deny issuing the report, and a forged or altered report fails verification. For counsel, it means a documented, independently verifiable answer when a recording's integrity is questioned. Admissibility is always decided by the court.

See our full chain-of-custody process.