Digital records and fraud: preserve context as well as files

The original is different from a working copy

A screenshot records what appeared on a display at one point in time. It does not necessarily establish who controlled the content or whether it has changed.

Where appropriate, preserve the original email and full headers rather than relying solely on an image. Record relevant web addresses and the circumstances in which material was obtained.

Document the circumstances of capture

Keep source files separate from edited versions used for analysis or presentation. Clear filenames and a simple inventory can prevent confusion.

A SHA-256 checksum can help identify whether file bytes changed. It does not independently establish that the content is genuine or admissible for a particular legal purpose.

Practical checks

• Preserve received files without modification
• Record the context of each collection
• Separate originals and analysis copies
• Limit access to sensitive materials

Technical markers have limits

Metadata may be missing, misleading or intentionally altered. Interpret it as one possible technical clue requiring further validation.

Experience in online research since 1999 has shown Alain Stevens the value of reproducible records and of acknowledging what a technical observation cannot prove.

Related resources

Build a suitable control

Vigifraude does not claim to provide court-certified evidence or regulated investigative services.

For a technical question, software project or training request, describe the need without sending credentials or unnecessary personal data.