SHORENET
← Shorenet Research Foundations

Unchanged Is Not the Same as Accurate

A hash proves a web capture has not changed since it was saved. It does not prove the capture shows what the website sent.

Ant Rose-Edwards

Published , revised , version 1.3

When web evidence is challenged, the argument is rarely about whether a file has been edited since it was saved. It is usually about whether the file shows what was really online. Those are different questions, and they need different answers.

Three questions, not one

Anyone relying on a capture of a web page is answering three separate questions, whether they say so or not:

  1. Integrity. Has the capture changed since it was made?
  2. What was online. Does the capture faithfully reflect what the website sent, at that time, at that address?
  3. Attribution. Who created the content, or controls the account?

Established practice already keeps these apart. The Berkeley Protocol on Digital Open Source Investigations, published by the UN Human Rights Office and UC Berkeley, treats an item being unchanged since collection as one property, and tracing content back to its original source as separate work. Verification is different again: checking the source, the file and the content.

What a hash proves

A cryptographic hash is a fingerprint of a file. If the fingerprint taken at capture matches the fingerprint taken when the file is produced in court, the file has not changed in between. That is valuable, and it answers the first question well.

The limitation is about where the fingerprint starts. A hash is calculated over whatever the capturing system saved, after it saved it. It cannot say whether that saved file matches what the website’s server sent, because the hash comes later, from the same party that made the capture.

NIST’s cryptographic definitions draw the same line. Data integrity is “a property whereby data has not been altered in an unauthorized manner since it was created, transmitted, or stored” (NIST SP 800-57 Part 1 Rev. 5). Authenticity is “the property that data originated from its purported source” (NIST SP 800-38D). They are different properties, and a hash speaks to the first.

UK policing recognised this some time ago. NPCC guidance on open-source investigation from 2015, which NPCC attached to a 2023 Freedom of Information response, put it plainly: “Evidence should always be corroborated or attributed in some way, but it is important to note that hashing is not sufficient for either purpose.”

The same paragraph is just as clear about what hashing is good for: showing that two files are identical, and checking whether something has changed in transit. The point was never that hashing is useless. It is that hashing answers one question, not three.

That guidance is now historic, and NPCC’s later Internet Intelligence and Investigations framework does not repeat the hashing point. The reasoning behind it has not changed.

Why it matters now

Current guidance keeps the underlying expectations. The College of Policing’s Authorised Professional Practice says open-source information should be corroborated by a different source rather than relied on alone, and that an audit trail should be kept in case research is used evidentially. CPS guidance on social media enquiries says screenshots “should be an approach of last resort when other methods have been explored or are inappropriate”, while also suggesting investigators record open-source searches with screenshots or body-worn video.

In most civil claims, CPR 32.19 lets a party serve notice requiring a disclosed document to be proved at trial. It reaches only documents disclosed under Part 31, and it does not apply to claims on the small claims track, where CPR 27.2 disapplies Parts 31 and 32 other than rule 32.1. In the Business and Property Courts, disclosure runs under Practice Direction 57AD rather than Part 31, and PD 57AD has no notice-to-prove provision of its own, but those courts have continued to apply CPR 32.19 to disclosed documents (for example Ndungu v SPG Ltd [2025] EWHC 3039 (Ch) at [288] to [308]). Section 8 of the Civil Evidence Act 1995 allows a statement in a document to be proved by producing a copy, whether or not the original still exists, “authenticated in such manner as the court may approve”. Neither tells you how to do it. Both mean you may have to.

And screenshots are challenged. In Peters v Joseph [2026] EWHC 775 (Ch), screenshots of emails were produced as fresh evidence on appeal. The judge said that on their face they appeared to be genuine screenshots of genuine emails, but the person shown as sending them said she had never sent them. He said disputes over their authenticity would need to be determined at a trial, and sent the question of whether a disputed declaration of trust was forged back for a re-trial, at which the emails can be relied on. In Mold Investments Ltd v Holloway [2025] EWCA Civ 986, a freezing order had been obtained relying on four screenshots of WhatsApp messages, which the defendant said were forgeries. The joint experts agreed that the messages in the screenshots appeared correct, but could not rule out that data had been deleted from the one phone that had been examined; several of the phones that might have held the original messages were no longer available. The Court of Appeal recorded that it was common ground that the expert evidence was unlikely to be determinative and that much would depend on the credibility of the witnesses, and directed that the challenge be heard together with the trial. The Supreme Court refused permission to appeal in December 2025.

Neither case is about a web capture. Both show the same gap. Once the original source is out of reach, a screenshot can end up resting largely on the word of whoever made it, and the dispute moves from the file to the people.

When a capture is disputed, a hash can show that the file in court is the file that was saved. The harder question is whether what was saved is what was online.

What independently checkable capture adds

Other parts of computing have dealt with this kind of problem by not asking anyone to take a single party’s word for it. Trusted timestamping (RFC 3161) has an independent authority bind a hash to a time. Certificate Transparency puts certificates into public, append-only logs that anyone can audit. Research such as TLSNotary and DECO addresses a related gap, that an ordinary encrypted web connection gives the user no way to prove to a third party what a server sent, but needs a notary or oracle to take part in the connection as it is set up.

Shorenet does not change the connection. The server’s own authentication of what it sends does the work. With a Shorenet Pilot relay, an independent witness also records the encrypted traffic the server sent, without being able to read it, so the record of what was online does not rest on the word of the person who made the capture. Shorenet operates the relay, and we say so; the check itself needs no Shorenet server or account.

Anyone will be able to check a .keel capture offline with the free, open-source Shorenet Validator, with no account and no server. Material that cannot be supported is set aside, never presented as evidence.

That moves the second question from “trust whoever captured it” to “check it yourself”.

Honest limits

Independently checkable capture answers the second question. It does not answer the third, and it does not replace good investigation.

  • It shows what a server sent, not that the content is true. A website can publish false information, and a faithful record of it is still a record of false information.
  • It does not identify a person. Showing that a page or post was served is not the same as showing who wrote it or who controls the account. In Peters, the person shown as the sender said she had never sent the emails at all. Attribution remains an investigative task, and parallel sourcing still applies.
  • It does not replace hashing. Integrity still matters, and hashing remains the right tool for it. The aim is to add the evidence a hash cannot provide, not to take anything away.

The legal points here concern England and Wales.

Being clear about these limits is part of the point. Evidence is easier to rely on when everyone can see exactly what it does and does not show.

See for yourself

The practical versions of this argument are set out as guides: screenshots as evidence, and social media evidence where the content sits on a platform.

The Shorenet Validator will be free, open source and run offline. If you would like to know when it is published, get in touch.

Sources

Shorenet builds evidence acquisition technology. We publish what our approach cannot establish alongside what it can.

Revision history

  • v1.3 Corrections after a follow-up check against the primary sources. Peters described accurately: the re-trial is of whether a declaration of trust was forged, at which the emails can be relied on, with pinpoints extended to [193] to [194] and [197]; the Supreme Court’s refusal of permission to appeal in Mold noted; the NIST definitions quoted with their sources; the NPCC guidance’s pinpoint corrected to para 4.2 and its FOI provenance stated accurately; a note added on disclosure in the Business and Property Courts.
  • v1.2 Corrections after a second source check. CPR 32.19 scoped to documents disclosed under Part 31 and to claims outside the small claims track (CPR 27.2); the Civil Evidence Act 1995 point attributed to s.8 and quoted; both case descriptions corrected against the judgments (Peters was fresh evidence on appeal remitted for retrial; in Mold the experts could not rule out deletion from the one phone examined, and the Court of Appeal directed the challenge be heard with the trial); the CPS guidance quoted rather than paraphrased; jurisdiction stated.
  • v1.1 Added cross-references to the screenshots-as-evidence and social-media-evidence guides.
  • v1.0 Initial publication.