The problem with looking first
A web page, a transaction record or a screenshot can change after it is collected — by accident, by a tool, or on purpose. If nobody can show that the copy in a report is the copy that was captured, the other side's expert will ask, and they will be right to.
Hash first, then everything else
When we acquire an artefact we compute its SHA-256 hash before any other process touches it. The hash, the time, the source and the method are written to our custody log in the same step. Only then is the artefact stored and made available for analysis.
A log that cannot be quietly edited
Each entry in the custody log includes the hash of the entry before it. Changing any past entry would break every link after it. At regular intervals we send the current head of the log to two independent RFC 3161 timestamp authorities, which return signed tokens stating when they saw it.
What the other side can check
Every export package carries a manifest of hashes, the timestamp tokens and written instructions. A third party can recompute the hashes with standard tools and confirm the timestamps without asking us for anything.
What hashing does not prove
A hash proves that a file has not changed since it was hashed. It does not prove that what the file shows is true. That is why our reports separate what was observed from what is inferred, and state a confidence level and limitations for each finding.