Pro Tier Module
Evidence Custody + File-Hash Integrity
Fingerprint digital evidence with SHA-256 and build a chain-of-custody log, entirely in the browser.
This tool runs inside GDBS Pro. What it computes and the authorities it applies are below.
The problem
Digital forensics needs a tamper-evident fingerprint bound to a custody record, but uploading evidence to a cloud service to hash it can break the very integrity the record is meant to prove.
The local-first solution
A deterministic, client-side tool computes the SHA-256 digest with WebCrypto and assembles a custody log that binds who handled the item to an exact fingerprint of what was handled, with the evidence never leaving the browser.
What it does
SHA-256 (FIPS 180-4) hex digest computed in-browser via WebCrypto
Constant-time verify of an expected hash against the computed one
Chain-of-custody log: date/time, custodian, action, location, notes
Custody record binds the SHA-256 to the evidence
Exportable, consistently formatted log
Legacy MD5/SHA-1 offered only to match a legacy tool, labeled as weak
Honest scope
SHA-256 is tamper-evident, not tamper-proof, and re-hashing an altered file just fingerprints the altered bytes. This is not a notarization, digital signature, or timestamp authority; it records what you enter and does not attest date, identity, or lawful acquisition. Pair it with an RFC 3161 timestamp or verified acquisition image.
Authorities cited
- FIPS PUB 180-4 (Secure Hash Standard) - SHA-256 (and SHA-1) specification. NIST, August 2015.
- W3C Web Cryptography API - SubtleCrypto.digest() computes the SHA-256 digest in-browser (no upload).
- NIST SP 800-86 - Guide to Integrating Forensic Techniques into Incident Response: hashing acquired data verifies integrity (a matching hash shows the data was not altered).
- NIST SP 800-101r1 - Guidelines on Mobile Device Forensics: chain of custody documents seizure, custody, control, transfer, and disposition of evidence.
- SWGDE Best Practices for Computer Forensic Acquisitions - acquisition images are hash-verified; document the chain of custody.
- RFC 3161 - Time-Stamp Protocol (a trusted timestamp authority; NOT provided here - pair it with this fingerprint for binding time attestation).
- NOTE: SHA-1 / MD5 have known collisions and are DEPRECATED for integrity (offered only to match a legacy tool's output - prefer SHA-256). MD5 is not provided via WebCrypto.
Get an email when these rules change
Tables, thresholds and deadlines in Legal & IP change every year. Leave your email and we will tell you when the ones behind tools like this one move, at most once a month.
We email you once to confirm. After that, unsubscribe from any issue in one click. Your address goes to VaultSync only (privacy).
Hash and log the evidence
Compute the digest and build the custody log in your browser, then attach the record to a Worklog case or share it through a Gate client portal. The evidence bytes are never uploaded to anyone's cloud.