Signed Hash Reports: Proving Who Issued a Deposition Record

Generative AI has made video easier to fake or alter, so counsel increasingly need to show that a deposition recording has not changed. SHA-256 hashing shows whether a file is identical to the one we preserved. On its own, it does not show who recorded those hash values or when. A digitally signed hash report answers both questions.

What the Report Contains

When the authentication package is ordered, we compile the SHA-256 values of each E01 forensic image, every file it contains, and each delivered MP4 into a single PDF report. We then digitally sign the PDF and anchor it with OpenTimestamps.

Offline Key Generation

Our signing keys are generated in a Tails virtual machine with no network access, then stored on a YubiKey hardware security key. The YubiKey is designed so the private key cannot be extracted or copied from the device, so only the holder of that key can produce our signature.

How Signing Works

Signing does not encrypt the report; anyone can open and read it. The PDF software calculates a fingerprint of the document, and the YubiKey signs that fingerprint with our private key. The signature and our signing certificate, which identifies us as the issuer, are embedded in the PDF.

Verifying the Report

Open the report in Adobe Acrobat or another PDF reader that supports digital signatures. A valid signature means the report has not changed since it was signed and that it was signed with our key. Any change to the report after signing, even a single character, invalidates the signature.

To check a delivered video, calculate its SHA-256 value with the tools built into Windows (Get-FileHash in PowerShell) or macOS (shasum -a 256 in Terminal) and compare it with the value in the report. If they match, the file is unchanged.

Proving When: OpenTimestamps

A signature shows who issued the report, but not when. OpenTimestamps records the report's fingerprint in the Bitcoin blockchain, a public ledger no single party controls. The proof file delivered with the report shows the report existed at that time, without relying on our word.

Non-Repudiation

Security engineers call this non-repudiation: because only our hardware key can produce our signature, we cannot later deny issuing the report, and a forged or altered report fails verification. For counsel, it means a documented, independently verifiable answer when a recording's integrity is questioned. Admissibility is always decided by the court.

See our full chain-of-custody process.