Resource · Evidence and audit

Evidence pack template

What a dated copy of a vendor page has to carry to be worth anything, and one real pack assembled from the record.

The eight sections

The order is an argument. Identity, then the two readings, then the raw difference, and only then our reading of it — a pack that leads with the finding asks to be believed before it has shown anything.

1. 1. What is being evidenced

   The vendor, the document, its URL, and the obligation of yours it touches.

   A pack with no subject is a folder. The first question is always what this is about, and the second is why it was yours to watch.

2. 2. The two readings

   For each: the date and time, the HTTP status, which fetch layer returned it, the URL it finally resolved to, and the hash of the content.

   The status and the final URL are what separate a page that changed from a page that moved. A redirect chain ending somewhere else is a different document, not a new version.

3. 3. What differs, verbatim

   Every added and removed line between the two readings, unedited.

   The pack has to survive someone disagreeing with our reading. An unedited diff is the only part of it that does not depend on us being right.

4. 4. What moved in the record

   The facts our extractor read as added, removed or changed — labeled as our reading, kept apart from section 3.

   These are two different kinds of statement. A line moved is what the page did; a fact moved is what we made of it. Merging them invites a reader to take the second on the authority of the first.

5. 5. The archived copies

   The stored PDF of each reading, with its own SHA-256, byte size and capture time.

   A hash proves two things are identical and nothing about what they say. The copy is what a reader opens; the hash is what ties it to this pack.

6. 6. The third-party timestamp

   The sweep manifest each reading appears in, the manifest's SHA-256, and the RFC 3161 token a timestamp authority signed over that hash.

   Everything above this line is our word. A signed token from a party with no interest in the answer is the section that makes the pack evidence rather than a record.

7. 7. What this does not prove

   Stated plainly: what a pack of this kind cannot establish.

   A pack that claims more than it holds loses on the first challenge. Naming the limits is what lets the rest stand.

8. 8. Who assembled it, when, and how to check

   The date the pack was generated, the method, and the URL to verify it against the live record.

   A pack is a copy of a moment. Saying so is the difference between a document that ages honestly and one that quietly misleads.

What a pack of this kind does not prove

A pack that claims more than it holds loses on the first challenge. Naming the limits is what lets the rest stand.

• That the vendor served this page to everyone. It is what the URL returned to our reader, at that time, from where it fetched.
• That the change happened on the date we recorded. It happened at some point between the two readings, and the pack states both.
• That the vendor did or did not send notice. The pack evidences a page; whether an email went out is a separate question.
• That nothing else changed. A pack covers the pages we read, and a gap in the reading is a gap in the pack rather than a quiet week.
• What the change means. The pack quotes and hashes; the reading of it is the reader's, or their counsel's.

Take it with you

The eight sections and the worked pack as a Word document. It is generated when you download it, so the pack inside is the one the record holds that day.

Common questions

What is an evidence pack?

A dated, hashed record of what a page said before and after it changed, assembled so somebody else can check it. Two readings with their times and content hashes, the verbatim difference, the archived copies, and a third-party timestamp over the whole reading.

Why is a screenshot not enough?

A screenshot shows what somebody says a page said, and the person you show it to has only your word for when it was taken. Nothing in the image ties it to a time that a party with no interest in the answer will vouch for.

What is an RFC 3161 timestamp?

A signed token from a timestamp authority attesting that a given hash existed at a given moment. Each sweep hashes a manifest of the readings it took and has that hash signed, so the time on a reading does not rest on our own clock.

Does an evidence pack prove the vendor changed the page on a particular date?

No. It proves the page said one thing at the first reading and another at the second. The change happened somewhere between them, and the pack states both times rather than picking one.

Why does the pack include the raw difference and not just the finding?

They are two different kinds of statement. A line moved is what the page did; a fact moved is what we made of it. A pack showing only the second asks a reader to take our reading on trust, and it has to survive someone disagreeing with it.