Which questions should the evidence answer?
Separate three questions: where the item came from, how it was handled and whether the exported bytes changed. Ask the vendor to demonstrate the evidence available for each question. A checksum addresses a comparison of file contents; it does not independently prove author identity, lawful collection or that the collection contains every relevant item.
Work through a realistic example
An analyst receives an export, copies it for review and creates a redacted derivative. Keep the received package, the working copy and the derivative distinguishable. Record who made the derivative and why. Comparing the derivative with the original checksum will naturally show a difference; that does not mean the original package was altered.
Run the workflow
- Select a known captured item and trace the available source identifier, capture timestamp and subsequent history. Ask what events are recorded and what remains outside the audit trail.
- Export the sample and record the operator, export settings, time and package identifier. Verify any supplied manifest using the documented method.
- Keep the original package in an approved location. Log transfers and transformations, and work on a separate copy during review.
Check the evidence
| Check | What to verify | Evidence to keep |
|---|---|---|
| Provenance | Source and capture details can be distinguished. | Item identifier and available metadata. |
| Handling | Review copies and derivatives have a documented lineage. | Custody and transformation log. |
| Integrity | A verification result is reproducible. | Manifest, method, tool version and result. |
Record the decision and its limits
Have the intended reviewer explain the evidence without relying on the vendor presenter. Record the unanswered questions and the exact scope of the test. If legal proceedings are involved, ask counsel to determine what evidence and handling procedure the matter requires.
Keep in mind: Do not describe a technical test as a guarantee of admissibility. The sample can show how a workflow behaves; the significance of that evidence depends on the specific matter and its requirements.
Further reading and scope
Reviewed October 14, 2026. These practical exercises are editorial guidance, not a guarantee of platform coverage or a substitute for your approved records policy.
- NARA: social media capture practices — Background on capture and metadata; the test exercises above are Brolly editorial workflows.
Common questions
Does an audit log prove capture completeness?
No. Inspect what the log records, compare the collection against a known sample and document capture limitations separately.
Can we edit the original package for convenience?
Use a working copy and preserve the received original under your approved procedure. Document transformations so reviewers can distinguish source material from derivatives.
Put the guide to work
Use the downloadable workbook to record your requirements, test results and questions for shortlisted providers.