Evidence & chain of custody

Evidence that does not ask to be trusted.

A third party — opposing counsel, a court-appointed expert, a prosecutor — must be able to establish, without trusting Ichnaro, that:

[01]
each artefact is bit-for-bit what was acquired;
[02]
it was acquired when and how we say;
[03]
we know every person and system that handled it;
[04]
our audit log has not been rewritten;
[05]
the report they hold is the one we issued.

[01]Principles

Principles

[01]

Hash first

SHA-256 is computed over the original bytes before anything else touches them.

[02]

Originals are never modified

Every derivation records the hash of the artefact it came from.

[03]

Everything is an event

Every create, read, download, export, seal and hold action writes a custody event — including every read.

[04]

Repeatable acquisition

On-chain evidence can be re-derived from any public node, with no trust in us at all.

[05]

Lawful acquisition only

Every artefact records the category of source it came from.

[06]

Aligned, not certified

We follow the principles of ISO/IEC 27037 — auditability, repeatability, reproducibility, justifiability — rather than claiming conformance.

[02]The custody chain, step by step

[01]
Acquire
Bytes come from our own blockchain nodes, an isolated capture worker for web pages, or a client upload through the console. Email attachments are not accepted as evidence.
[02]
Hash
SHA-256 over the original plaintext bytes — before anything else touches them.
[03]
Encrypt
AES-256-GCM envelope encryption with a per-object key, wrapped by a per-client key.
[04]
Hash the stored copy
The stored ciphertext is hashed as an operational integrity check.
[05]
Store in the EU
Written to EU-jurisdiction object storage under a lock-protected prefix. Objects are never overwritten.
[06]
Read back and verify
The stored object is read back and its hash checked.
[07]
Immutable second copy
The same ciphertext is written synchronously to a second, write-once copy in another EU region, whose retention no one can shorten.
[08]
Record, then acknowledge
The item and its custody event are recorded. Only then is the ingest acknowledged. Nightly reconciliation means nothing is lost silently.

[03]

A log that cannot be quietly rewritten

Each custody event includes the hash of the event before it, in a single chain. Every day the events are also gathered into a Merkle tree, so a client can be given proof of its own events without seeing anyone else's.

Independent timestamps

The head of the log is anchored every hour — and immediately when a report is sealed, an export is created or a legal hold is placed — with at least two independent RFC 3161 timestamp authorities. Sealing a report is blocked if anchoring fails.

[04]

Protection layers

SHA-256 at ingest
Append-only, hash-chained audit log
RFC 3161 anchoring by external timestamp authorities
Lock administration restricted to a break-glass account
Continuous monitoring of lock configuration
Immutable second copy in another EU region

[05]

What a web capture contains

Request and response headers
Page HTML as served, and the rendered DOM
Web archive of the page
Full-page and viewport screenshots
TLS certificate chain
DNS and RDAP records
Certificate-transparency entries
Capture metadata: start and end time from a synchronised clock, operator, purpose, source category

Captures use ordinary public access only: no logins, no form submissions, no clicks beyond page load.

[06]

On-chain evidence

Transaction hash, block height and hash, block timestamp, raw transaction, decoded transfers and confirmations, with the node software and version used. Items stay flagged unconfirmed until they are final. Clustering and labels are derived analysis, not evidence of identity on their own.

[07]What an export package contains

What an export package contains

Packages are watermarked per recipient and delivered by authenticated download or an encrypted archive. Never as an email attachment.

manifest.json: Every file with its path, SHA-256, size, media type, acquisition time and source category
manifest.json.sig: Detached signature over the manifest
manifest.json.tsr: RFC 3161 timestamp token over the manifest
audit/: Custody events and Merkle inclusion proofs
certs/: Signing certificate and timestamp-authority chains
evidence/ · report/: Original artefacts and the sealed report with its seal file
VERIFY.md · verify/: Written instructions and an open-source verifier

[08]Verify it yourself

Verify it yourself

With standard tools only:

# 1  Files
sha256sum -c <(jq -r '.files[] | "\(.sha256)  \(.path)"' manifest.json)

# 2  Signature and timestamp
openssl dgst -sha256 -verify <(openssl x509 -in certs/ichnaro-signing.pem -pubkey -noout) \
  -signature manifest.json.sig manifest.json
openssl ts -verify -data manifest.json -in manifest.json.tsr -CAfile certs/tsa/<tsa>-chain.pem

Recompute each custody event hash from its fields and the previous hash, and check the Merkle proofs against the anchored daily roots.
Re-derive on-chain evidence from any public node or explorer.
Check a report on its own at app.ichnaro.com/verify — the hash is computed in your browser and the file is not uploaded.

This procedure is written for scrutiny by non-lawyers. Admissibility and authentication rules differ by jurisdiction and are reviewed with counsel for each one.