Four things worth seeing for yourself
Everything below is interactive, and none of it is a mock-up — the hashes are computed in your own browser as you type. It is the shortest honest answer to “how do you actually know that?”
- 01
Acquire it
Sealed, write-blocked, imaged and verified
- 02
Recover it
What deletion leaves behind, and what overwrites it
- 03
Prove it
Why one character changes the whole digest
- 04
Corroborate it
Why one source is never enough
From seizure to a copy that can be trusted
Acquisition is where a case is usually won or lost. Every step below is documented as it happens, so the examination that follows rests on something a court can check.
The clock starts at the seal, not at the lab.
The device goes into a tamper-evident bag with a numbered seal, photographed in place. From here on, every person who touches it is recorded.
SEAL #0001 · intact
Photographed in place before the bag is opened.
Chain of custody
- logged
Seized and sealed
Seizing officer · Tamper-evident bag #0001
- 2—
Connected read-only
Examiner · Hardware write blocker verified
- 3—
Image acquired
Examiner · Full physical image, sector by sector
- 4—
Hash verified
Examiner · Source and image digests match
- 5—
Returned to vault
Evidence custodian · Re-sealed; analysis on copy
Every handoff is recorded as it happens. A gap in this log is the first thing a defence expert looks for.
Deleted doesn't mean gone — until something overwrites it.
Deleting a file removes the pointer to it, not the data. Watch what a carver still finds on the platter, and what gets lost the longer a device stays in use.
On disk. The photo occupies a run of sectors, and the directory entry points at where it starts. Everything behaves normally.
recovery pending
Simplified for clarity: real volumes fragment files across non-contiguous sectors, and an SSD's TRIM command can zero freed blocks within seconds — which is why flash storage and spinning platters are treated as two different recovery problems.
Change one character. Watch the seal break.
A cryptographic hash is what turns a hard drive into evidence that can prove its own integrity. Alter a single byte and the digest changes beyond recognition — which is exactly why it holds up under cross-examination.
Evidence note
editableThe sealed digest was computed on our server with Node's crypto; the live one is computed in your browser with the Web Crypto API. Nothing is uploaded, and both match any other SHA-256 implementation you care to check them against.
Byte-for-byte identical. The exhibit is provably unaltered since acquisition.
One source is an account. Three are a case.
Independent records built for unrelated purposes are hard to reconcile by accident. Switch the sources below on and off, and watch what the same evening looks like with each one added.
The account given
“I was at home all evening, from eight until the morning.”
A single source is an account. The handset shows activity, but nothing here independently establishes where it was. On its own this neither supports nor contradicts what was said.
An illustration, not a real case. The times and places are invented; the reasoning is the one that decides contested matters — cell-site records show a sector and a bearing rather than a point, so they are read alongside other sources, never in place of them.
The same methodology, applied to real cases
Six investigations documented end to end, from seizure through to courtroom outcome.
Read the case studies