Primer

Evidence Authentication for Digital Files

What a SHA-256 hash anchored on Polygon shows about a file, and how it relates to FRE 901(b)(9), Daubert and chain of custody. Courts decide admissibility.

The authentication question

When a photograph, PDF, or video file is introduced as evidence, the question isn't whether the file can be opened. It's whether the file in front of the court is the same file that was created at the time and place being claimed. Traditional digital evidence workflows rely on metadata (EXIF, file-system timestamps), custodial testimony, and hash values that match between collection and presentation. Each of those has failure modes. Metadata can be edited by any user with file access. Custodial testimony can be challenged. A hash value shows a file is unchanged only if the original hash was recorded somewhere independent and tamper-evident.

Blockchain anchoring addresses the "somewhere independent and tamper-evident" part by recording the SHA-256 hash on a public ledger that many independent node operators keep copies of.

FRE 901(b)(9): authentication by process

Federal Rule of Evidence 901(b)(9) authorizes authentication by "evidence describing a process or system and showing that it produces an accurate result." A party can offer evidence about SHA-256 and blockchain anchoring under this rule. Whether it is enough is for the court:

Daubert factors

The Daubert standard (Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579 (1993)) asks four things of expert methodology:

  1. Testability: SHA-256 is deterministic. Given the same input, the same hash is produced. Always reproducible.
  2. Peer review: SHA-256 is NIST FIPS 180-4. Blockchain consensus is extensively published in peer-reviewed computer science literature.
  3. Error rate: the best known way to find two files with the same SHA-256 hash takes about 2128 attempts. No practical SHA-256 collision has ever been found.
  4. General acceptance: SHA-256 is a NIST standard. Whether blockchain timestamps meet the general-acceptance factor is for each court to decide.

Chain of custody

Chain of custody requires documenting that evidence has not been altered between collection and presentation. A hash anchored when the file is collected gives a tamper-evident baseline. It covers only the file's integrity from the anchor time on; who held the file, and when, is still for the custody record:

Timing: record before you need it

A proof shows that a file existed from the moment its hash was anchored, not earlier. To be able to show that a file existed before some later event, record the proof before that event.

ProofLedger's implementation

ProofLedger anchors each file's SHA-256 hash to the Polygon blockchain in its own transaction, usually within a minute. The transaction is public, so the anchor can be checked on any Polygon block explorer, and every proof has a downloadable bundle that verifies with the open-source verify-proof package without ProofLedger.

Verification does not need us: check the file against its bundle with verify-proof and look up the transaction on any Polygon explorer. For convenience, our public endpoint GET /api/v1/verify?hash=<sha256> (documented here) also answers lookups, up to 120 per hour per IP address.

ProofLedger does not assert authorship, ownership, rights, intent, or truth about any file. It shows that a file with a specific SHA-256 hash existed by a specific time. What the file means is a matter for the parties and the tribunal.

Related resources

Record your first proof

Proof of existence as an API: send a hash, get a Polygon-anchored certificate anyone can verify without us. Your files never leave your machine; only the hash goes on-chain.

Get a free key See pricing