Digital evidence: AI provenance and custody records

Learn in your browser · Chapter 01 of 08

A file can be unchanged since receipt and still depict a staged event, contain a mistaken statement or have an unknown earlier history. Begin by stating exactly what your record establishes and what remains unverified.

This workbook concerns the integrity of material already received under an organisation's approved process. It does not teach device seizure, covert collection, suspect profiling, identification of people or operational surveillance. Our fictional Harbour Evidence Unit receives two training exhibits: a text representation of an invented audio exercise and a small invented document. No real case, person or offence is represented. You will design a provenance pack that lets another reviewer distinguish what arrived from what software and people later produced. The educational problem is an unjustified leap from a useful processing aid to an apparently authoritative account.

Use four separate questions. Integrity asks whether specified bytes match a trustworthy earlier reference. Provenance asks what is recorded about origin and processing history. Reliability asks whether a method produces results fit for the stated purpose under relevant conditions. Admissibility is a legal question determined under the applicable rules and circumstances. None is a synonym for another. A checksum does not hear an audio recording, test a speaker's truthfulness or decide whether evidence can be used in proceedings. State the checked object and comparison point every time you report integrity, rather than attaching an unexplained verified badge.

In the teaching package, preserved source means the exact bytes accepted at the recorded receipt boundary. That operational label is not a ruling about the legal meaning of an original. The US Federal Rules of Evidence use specific definitions and authentication requirements; the current official compilation distinguishes Rules 901, 902 and 1001 to 1003. Federal rules do not automatically govern state proceedings or other jurisdictions. England and Wales has its own framework, including the Forensic Science Regulator's applicable activities and code. Choose your study pathway and record the unresolved local requirements before making any deployment or evidential-use claim.

Human control starts with decision rights. An operator may prepare a permitted working copy; a qualified examiner evaluates a method within their competence; a disclosure professional and legal decision-maker apply their own duties. A language model cannot acquire those roles by writing a confident paragraph. Define who can change a package, who can review it and who can authorise release. Separate those permissions from ordinary account access. A staff login demonstrates access under a credential system, not that the person understood a transformation or approved the specific material being sent. The final release should identify a package version and accountable decision.

Make uncertainty visible before processing begins. The received audio exercise may have a supplied timestamp without a verified clock history. The document may be an export rather than the originating application record. Record both the sender's statement and what the intake operator actually observed, with distinct labels. Do not repair the uncertainty by inventing an earlier custody event. A gap can remain explainable and reviewable; a fabricated completion destroys that distinction. In a real service, preserve competing accounts and route consequential uncertainty to the appropriate reviewer instead of allowing a summariser to select the neatest story.

1. Write the intended educational claim, the protected material and the decisions excluded from automation.
2. Identify the receipt boundary and label the material as received without implying that all earlier events are known.
3. Choose the relevant jurisdiction pathway; assign unresolved rule and activity-scope questions to a competent reviewer.
4. Separate observed facts, supplied statements, software outputs and human interpretations in the record.
5. Name the owner of each decision and require an explicit hold when essential authority or information is missing.

Learn in your browser · Chapter 02 of 08

Copying, decoding, transcription, correction and redaction create different relationships. A useful provenance graph makes those relationships explicit so a convenient derivative never silently replaces the material from which it was made.

An exact working copy can share the source bytes while receiving its own storage and access record. A decoded text extraction, audio transcript, cropped image or redacted document is a derivative even if it is useful and carefully reviewed. A human correction is another version, not a reason to overwrite the earlier AI output. Give each artefact a stable identifier, role, byte count and digest. Record its parent identifiers and the process that produced it. A descriptive filename can help a person navigate, but it is not a substitute for those relationships and may change during transfer.

Harbour's teaching graph begins with E-A as the received audio-exercise text and E-D as the received document. W-A and W-D are exact working copies. T-1 is an authored simulation of an AI transcript, C-1 is a human-corrected transcript and I-1 is a document index. C-1 records both T-1 and the source consulted during correction. An eventual disclosure view R-1 has its own restrictions and digest. These labels describe a classroom package, not a prescribed national exhibit-numbering system. Your organisation's approved identifier rules remain a separate requirement in real work.

Preservation is a control problem, not a folder name. A directory called originals does not stop a process with write access from changing it. Specify separation of privileges, protected reference records, backup and restoration procedures, access logging and incident handling at the appropriate layer. This course's small in-memory exercise cannot enforce filesystem or storage permissions. It demonstrates detecting certain inconsistencies against supplied references. A real preservation design needs evidence about the actual storage service and operators. Do not advertise immutable storage merely because a user interface hides the edit button.

A transformation can preserve readability while losing information. A converted document may omit comments, revision history, attachments, fonts or layout relationships. A media export may change a time base or discard metadata. Retain the received source and document the conversion purpose, tool, settings and observed limitations. A convenient open representation can help reviewers without becoming a replacement for the source. NIST IR 8387 discusses preservation and future accessibility of digital evidence. Its preservation guidance is technical reference material, not a certificate that a particular storage product or workflow meets every evidential requirement.

A graph must support negative questions: which source was not processed, which output failed, and which paths have no recorded parent? Do not restrict it to successful final outputs. If a transcript generation fails halfway, retain the attempt record under the applicable policy and label the output partial. If two different sources are accidentally assigned the same identifier, reject the package rather than merging their histories. A cycle, such as a correction listed as its own ancestor, is structurally invalid for this teaching graph. Detecting such a cycle is useful bookkeeping, not proof that every valid-looking relationship is true.

1. Inventory each received item and the exact boundary at which its reference digest was recorded.
2. Assign distinct identifiers to source, exact copy, machine derivative, human correction and disclosure view.
3. Record parent links and whether a relationship asserts exact copying or documented transformation.
4. Retain failed, partial and superseded outputs as policy requires; never promote them silently into source roles.
5. Test graph closure, unique identifiers and absence of ancestry cycles before technical review.

Learn in your browser · Chapter 03 of 08

A custody record needs people, objects, actions, times and exceptions. Hashes help compare specified data, but they cannot supply missing observations or make an editable event history independently trustworthy.

Define the unit of an event before designing the log. A transfer event can identify the artefact, sender, recipient, purpose, time recorded, location or system reference, and observed condition. An examination event can identify the approved method and the new artefact it produced. A review event identifies the exact package version examined. Keep timestamps with their offset or other clock context, and distinguish when an action reportedly occurred from when a person entered the record. A later correction should preserve the earlier entry and explain the correction, not silently rewrite the sequence to look tidy.

A digest such as SHA-256 is a compact result of processing bytes with a specified algorithm. Comparing two digests is useful only when you know which bytes each covers and trust the reference sufficiently for the claim. Hashing a decoded text string is different from hashing the original encoded file; line endings, byte-order marks and container metadata can matter. Choose the object explicitly. In this lab, hashes cover exact UTF-8 fixture bytes, while event hashes cover a declared canonical JSON representation. That convention is limited to this exercise and should not be assumed compatible with every external tool.

Consider the simplest tampering failure: an editor changes a file, calculates its new digest and replaces the digest stored beside it. A check against that edited reference passes. NIST IR 8387 explicitly discusses weaknesses involving both material and stored hashes. A useful design therefore protects the reference separately from the ordinary processing path and records how it was established. Our exercise accepts a trusted baseline supplied by the caller and shows what happens if that baseline is also replaced. It cannot make the caller's baseline trustworthy; that is an explicit assumption to test in a real system.

Linking each event to the previous event's digest can expose an accidental edit or missing middle entry when the expected anchor is protected. It does not prevent a sufficiently privileged actor from rewriting the entire chain and its anchor. Digital signatures can add evidence about use of a signing key, subject to key control and verification policy; they do not prove that every statement signed was true. Never describe the classroom chain as immune to alteration. Describe its checked relationships, the trusted anchor and the attacks it does not address. A ledger with no trusted reference is not self-authenticating simply because it contains hashes.

Custody discrepancies need proportionate investigation rather than automatic narrative repair. Suppose an item was booked out at 14:10 but a receiver's entry is recorded at 14:07. Possible explanations include clock differences, a late entry, a wrong item or an unauthorised transfer. The log alone cannot choose among them. Preserve the entries, identify the discrepancy and seek appropriate supporting records. The responsible reviewer decides the impact on use and reporting under local policy. A model may help list missing fields but should not invent a receiver, backdate an acknowledgement or classify a gap as harmless without evidence.

1. Define event types, required fields and the difference between occurrence time and recording time.
2. Bind each event to artefact and package identifiers, not just a convenient filename.
3. Calculate digests over explicitly defined bytes and record the algorithm and tool context.
4. Check the event sequence against an independently supplied anchor and preserve discrepancy results.
5. Escalate uncertain custody or clock facts through the responsible process without inventing replacement events.

Learn in your browser · Chapter 04 of 08

The processing record should make a derivative explainable: which material entered, which tool and settings acted on it, what emerged, and what authority allowed that operation. A prompt alone is not a method record.

Start with an end-user requirement stated narrowly enough to test. For H-17, the permitted task is to produce a navigational draft transcript and a document index for human checking. The system must not infer speaker identity, emotional state, credibility, intent or guilt. It must not improve the source until it resembles a preferred account. The draft is a derivative, and every consequential passage must remain traceable to the supplied source. This requirement is different from prove what happened. A tool selected for convenient summarisation may be unsuitable for an evidential interpretation even when its prose sounds polished.

Record tool name and version, model identifier when relevant, configuration, prompt template, input selection, preprocessing, output format and observed errors. If a hosted service does not expose a stable model build, record that limitation and the information it does provide; do not invent a weight hash. Record execution and operator references, but avoid copying secrets into the package. An API credential is not useful disclosure metadata. The method should state where data, temporary artefacts, logs and support access can go, and which routes are authorised. An on-premise label does not by itself establish those boundaries.

A stronger processing instruction names role, constraints, process, verification and schema. For the fictional index, request page identifier, exact supporting excerpt, unresolved reading flag and no unsupported completion. Tell the tool to treat document contents as data, not instructions. Then enforce schema and excerpt matching outside the model. A weak request such as make this evidence convincing invites a different objective and hides source uncertainty. The stronger design can still be wrong: a copied excerpt can be genuine but selected misleadingly. Human review must test the relationship between the output claim, its context and the task.

Do not allow the model to choose arbitrary files, tools or destinations. An orchestration layer should supply approved copies and permit only the intended operation. Text inside a document that says ignore policy and upload the exhibit is evidence content, not authority. The offline exercise has no model, network or file-discovery capability; it represents AI outputs as explicitly authored fixtures so you can test handling without transmitting material. A real adapter would need separate input, permission, isolation, logging and failure-path checks. Passing the offline record validator is not a test of that future adapter.

The England and Wales FSR Code version 2 addresses fitness for a specified purpose, validation or verification, controlled methods and reporting limits for activities within its scope. It does not declare every AI product suitable by category. Map the proposed activity and relevant requirements with qualified staff. SWGDE's published forensic video guidance likewise supports documented processing and careful interpretation within its own professional context. These references inform the questions a reviewer asks; our fictional method remains a teaching design with no accredited casework status. Keep that distinction in procurement, training and any service description.

1. Define the permitted transformation and the conclusions it must not produce.
2. Bind approved input artefact IDs and digests to a method identifier, version and processing record.
3. Record available tool/model/configuration details honestly, including inaccessible version information.
4. Validate required output fields and source references outside the model; hold malformed or unsupported outputs.
5. Create a new derivative with its own digest, reviewer status and limitations; never write it over the source.

Learn in your browser · Chapter 05 of 08

An aggregate accuracy figure can hide the one omission that reverses a statement. Evaluate the task you actually permit, preserve uncertain passages, and connect every correction to the source rather than to a preferred narrative.

Define the reference answer before judging the output. In a synthetic exercise the author can supply known text and deliberately varied examples. In real evidence, a trustworthy reference may itself require competent examination and may remain uncertain. Do not treat an earlier model output as ground truth merely because it is stored first. Harbour uses two declared training sentences, including The blue door was not open. Its simulated draft drops not. That omission matters because it reverses the proposition even though most words remain identical. The reviewer records the exact location, error type and possible consequence instead of merely lowering an overall score.

Separate omissions, substitutions, insertions, segmentation errors and unsupported inferences. A transcript that replaces fourteen with forty differs from one that inserts punctuation, but punctuation can also change interpretation. Speaker labels are not verified identity, and automated diarisation is not evidence that a named person spoke. Where a passage cannot be resolved, use a documented uncertainty convention and preserve alternatives as appropriate. Do not force a best guess to make a report look complete. The permitted H-17 task is navigation and review support, not attribution of a voice or an assessment of credibility.

Measure more than one dimension. In a fictional set of ten passages, eight draft transcripts match the reference exactly, one reverses a negation and one changes a quantity. Exact-passage agreement is eight divided by ten, or 80 percent, on that set. It is not an evidential reliability rate and says nothing about an unseen accent, language or recording condition. Record the two consequential failures separately. For an index, count required source items present, unresolved items and invalid references. A result covering nine of ten required items has a known completeness gap even if all nine links work.

Review scope must match the proposed use. A navigational index may support finding passages for direct examination but should not become the only material a decision-maker reads. Sampling can reveal failures, yet a clean sample does not establish that every unreviewed passage is correct. Choose a justified checking strategy with the relevant quality owner and state its limitations. Use reviewers with the required competence and access to the source. Blind or staged checks may reduce avoidable influence from a draft, but no single interface pattern eliminates bias. Preserve substantive disagreements rather than averaging them into an unexplained consensus.

An enhanced image or cleaned audio may improve readability while creating a misleading impression of detail or certainty. Keep the processing record, source and comparison view. Do not infer a face, registration mark or missing word from a generative reconstruction and report it as observed source content. This course neither performs such reconstruction nor teaches identification. Its integrity lesson is that plausible new detail is a transformation result, not a newly discovered original fact. A tool's visual quality or fluent language cannot settle whether a particular feature was present in the supplied evidence.

1. Define the permitted use and relevant error categories before reviewing outputs.
2. Select appropriate reference material and record unresolved uncertainty in the reference itself.
3. Compare consequential passages and source locations; distinguish errors from unsupported conclusions.
4. Record per-category results, denominator, conditions and unreviewed material instead of a universal accuracy claim.
5. Create versioned corrections or holds with reasons, and preserve the prior derivative and reviewer disagreement.

Learn in your browser · Chapter 06 of 08

Reproducing a result, detecting a corrupt record and validating a method are related but different tasks. Build tests that can fail for meaningful reasons, retain those failures and identify the assumptions the tests never exercise.

A repeat run asks whether a stated process yields the same result under stated conditions. A deterministic text extraction may be byte-repeatable in a pinned environment. A model-backed interpretation may vary with provider changes, runtime behaviour or sampling settings. Record what was actually repeated: inputs, versions, parameters, output bytes and comparisons. If a provider cannot reproduce an earlier build, preserve the earlier output and method record and state the limitation. Do not replace it with a new plausible answer and call the history reproduced. Reproducibility of an erroneous method would still reproduce the error.

Method validation addresses whether the method is fit for its particular purpose and expected conditions. Choose acceptance criteria before viewing the results, including important error categories and unsupported cases. A demonstration that a parser accepts one valid file is not a challenge of malformed files, mixed encodings, missing pages or permission boundaries. Include realistic benign variation as well as adversarial fixtures. Keep development examples separate from held-out evaluation examples where appropriate. If you tune the method after a failure, record a new version and re-evaluate the affected scope rather than relabelling the earlier test as a pass.

The supplied evidence_lab.py uses only built-in fictional byte strings and declared records. It performs no model inference, audio recognition, file acquisition, network request or production storage operation. The baseline contains source and copy artefacts, a simulated transcript and a correction, processing metadata and a hash-linked custody record. The checker verifies selected structural and byte-integrity conditions against a separately supplied baseline. It is deliberately small enough to inspect. It cannot establish actual custody, lawful collection, valid signatures, reliable clock measurements, filesystem isolation, staff competence or court admissibility.

Challenge one property at a time. Change source bytes without changing the recorded digest; then change both and compare against the separate receipt reference. Introduce an exact-copy mismatch, a missing parent, a duplicate identifier, a cycle and a derivative with missing tool metadata. Tamper with a custody event and remove an anchor. Alter the package after review to test whether the review remains bound to the exact digest. Use explicit expected outcomes before running each case. A test that only checks the program printed success is weak; a test should assert the specific denial or accepted invariant.

A useful test suite also proves its own limits. Rebuild a maliciously edited chain and supply the replacement as the supposed trusted anchor: this teaching checker cannot recover the discarded external truth. Give it internally consistent but false actor references: it has no identity service to challenge them. Those are documented non-goals, not defects repaired by adding more optimistic labels. The exercise should help you specify the missing storage, authority and independent evidence controls. Never deploy a classroom validation function as a production evidence-management service simply because its unit tests all pass.

1. Inspect the exercise source and README before running it in a local Python 3 environment.
2. Run the baseline and tests without adding real material, external packages or credentials.
3. Record expected and observed results, source hashes, Python version and the scope of each check.
4. Introduce one deliberate mutation to a protected condition and confirm the relevant regression test detects it.
5. Write an evidence statement that separates fixture results from untested integration, model and professional claims.

Learn in your browser · Chapter 07 of 08

A technically consistent package can still be incomplete, misleading or shared without authority. Prepare a handover that exposes the material, processing history, failures and restrictions needed for the applicable review process.

Separate internal preservation from a particular disclosure view. The source, processing records, rejected outputs, corrections and review decisions may have different access controls and retention requirements. Do not assume that every recipient should receive every file, or that a redacted view permits destruction of the underlying material. Identify the purpose, authorised recipient, legal or policy basis and applicable restrictions through the proper process. Record what was included, what was excluded and why, with restricted details available to appropriately authorised reviewers. The course supplies a handover method, not a case-specific disclosure or retention decision.

For England and Wales, CPS digital-material guidance stresses early consideration of disclosure, proportionate review and transparency about the approach taken. The current page records an update on 18 June 2026. Use it within its prosecution context and alongside the applicable rules and professional advice; do not transplant it as a universal police policy. An AI index that fails to surface contradictory material does not remove the need for the authorised disclosure process. In H-17, the negation omission and failed annex claim belong in the reviewable processing history, even if an attractive final summary would be shorter without them.

The United States federal reference pathway is narrower than all US practice. Rules 901 and 902 address authentication and particular self-authenticating categories; the electronic-record and copied-data provisions have conditions involving certification and notice. Do not describe a classroom digest or Mickai course certificate as satisfying those conditions. State rules, other courts and particular proceedings may differ. For Scotland, Northern Ireland and other or cross-border work, this course does not assert a reviewed local-law framework. The learner should identify the relevant jurisdiction, applicable procedure and qualified reviewer rather than silently inheriting England and Wales assumptions.

Content Credentials or another signed provenance structure may supply useful statements about an asset's processing history under its trust model. C2PA's explainer distinguishes provenance information from whether the depicted content is true or factual. Check the actual credential, binding and verification result where that technology is in scope, and preserve the result with its limitations. Absence of credentials does not prove fabrication; a valid credential does not prove the underlying event happened. Our exercise does not implement C2PA or verify signatures, so its plain digest manifest must never be labelled a validated Content Credential.

Retention must be reasoned and accountable. Keep a register of the applicable retention basis, preservation holds, review date, responsible owner and controlled disposal process. A storage-cost target does not override a preservation obligation, and an unsupported keep everything forever policy can create privacy and access risk. Do not invent a fixed national retention period for this course. If an authorised correction, restriction or deletion decision affects multiple copies, record how the change reaches relevant systems and recipients without concealing the earlier history. The lab contains no deletion function because those decisions exceed its educational scope.

1. Select the relevant jurisdiction pathway and record unresolved local procedural questions.
2. Inventory the source, derivatives, failures, corrections and review records that the responsible process must consider.
3. Prepare a release manifest identifying exact versions, restrictions, exclusions and their authorised reasons.
4. Check the recipient route and the package digest immediately before release; retain the review decision for that version.
5. Record retention responsibilities and future review triggers without using an invented universal period.

Learn in your browser · Chapter 08 of 08

Integrate the lessons into one inspectable package. Your result should make the source, transformations, authority, failures and limitations understandable to a reviewer who was not present when you built it.

Allow about fourteen focused hours for the whole course, including reading, exercises, test review and this capstone. This is an unpiloted author estimate, not measured learner completion time. Work in stages and retain notes on why you changed a decision. The capstone uses the H-17 synthetic audio-transcript and document-indexing scenario. It is deliberately small: depth comes from accountable relationships and challenged assumptions, not from a large folder of plausible generated files. No real case data, credentials, live evidence platform or model download belongs in the submission.

Produce a claim register, artefact inventory, lineage graph, custody record, transformation contract, quality report, jurisdiction record and proposed handover manifest. Include the exact source and test version you ran, expected outcomes, observed results and retained failures. Explain who would own the missing real-world controls. The pack should let a reviewer answer which bytes arrived, which derivatives differ, what generated them, how corrections were made and which claims remain unsupported. A beautifully formatted report with no traceable inputs is weaker than a modest pack whose evidence can be inspected and challenged.

Add three adversarial review events. First, change a reviewed transcript after the reviewer signs the package digest and show that release is held. Second, remove a source ancestor and show that the missing relationship is detected. Third, rebuild a changed custody chain with a replacement anchor and explain why a separately retained original anchor is needed. Use invented reviewers and explicitly supplied authority flags. Those flags simulate the decision boundary; they do not authenticate a person. A real service needs protected decision records and enforcement at the actual transfer boundary, which this fixture does not provide.

Assess the dossier across five areas: clear claims and scope, preserved source and lineage, reproducible record checks, substantive output review, and a defensible handover decision. Assign twenty learning-review points to each. Above 80 out of 100 is a useful practice target, but an unresolved critical source or authority gap prevents a ready-for-release recommendation regardless of the total. This is an ungraded capstone rubric, not the online knowledge exam. A well-evidenced hold can demonstrate good learning because it recognises what the available evidence cannot support.

The paired knowledge assessment contains forty mapped scenario questions. A sitting draws twenty equally weighted questions, including every chapter, and requires strictly above 80 percent: sixteen correct fails and seventeen passes. Written responses and the capstone remain ungraded practice with worked reasoning. A named, dated Mickai educational certificate records the stated assessment and its issuance status; it is not professional accreditation, identity assurance, forensic competence authorisation or approval of a real system. Take the official Mickai knowledge exam using the course exam link; certificate verification concerns the recorded issuance and assessment result.

This course is part of Mickai's Trust Agent mission to make AI more trustworthy and human-controlled. Practical sovereignty here means control over data access, processing permissions, model and tool choice, keys, review decisions and an exit path that preserves usable records. A download event is not a unique learner and a chapter review mark is not an exam pass. Keep those measures distinct from certificate issuance and demonstrated real-world performance. The educational work delivered here does not establish that Mickai operates an accredited evidence platform or a verified police-system connector.

1. Assemble the eight-part dossier and check that each claim points to relevant evidence or an explicit unresolved item.
2. Run the baseline, negative tests and one mutation check; retain the actual output and source hashes.
3. Challenge the final package after review and show how changed content invalidates the simulated release decision.
4. Ask a second reader to trace the omitted negation from source through T-1, correction and proposed handover.
5. Record a reasoned educational readiness decision, remaining integration gates and what the certificate would not establish.