I'm kinda new to the process of timestamping files to provide digital integrity. For testing purposes, i use tsa.safecreative.org for PDF files.
Now i've signed a couple PDF files and if i open up the PDF it says the timestamp is valid (as the file is signed by the timestamp certificates). Nevertheless, one of the key ideas of timestamping is to be evidence proof, so i should be able to use the list on the SafeCreative Website to verify the timestamp of my file.
When taking a look at the exact time of timestamping i know that SafeCreative safes the following data for my demo file.
2015-12-16 21:17:27 5488602bec5c55a91e474c2b79d6c1a02928d594c472be54307e3cc8cec3cd90 SHA256
Now lets assume that this demo file is part of a court process. I want to verify that the file was timestamped at that exact time. According to defuse.ca the SHA256 hash is bc5886d2890da95d04b5ec4fbba7881a2cabb38ba87ae27daf5870c381facbbe though this is obviously the hash after the timestamp-adding-certifications.
How exactly would i proof in court that the PDF i got was timestamped at that moment (i dont think the certificate is proving timestamping instead of file integrity)? Is the "old" hash somewhere in the file? Do timestamp servers even store the hashes and if yes, why is there no API to check it?