Has anyone used a file hash to prove authenticity of a file during legal proceedings?

Question

I've had a client come to me with a request for a feature to prove that a file uploaded to a cloud service we run is the same as the one that they subsequently stored in their document management system. They would need to do this well after the originally uploaded file was deleted. They would need to provide this proof as evidence during legal proceedings.

My knee-jerk reaction is to implement a feature to md5 hash the file on upload to the cloud service and store the result as an audit record. This would allow for later comparison with a hash of the file from their document management system.

I'm also wondering whether basic (non-computed) metadata about the file and then compare that to the downloaded file could be enough - filename, file size etc.

This is really a digital forensics question. Does anyone have any experience in this area? How strong does the proof need to be? What could we implement to prove that the two files are the same under the assumption that one would be deleted? Any sources of guidance would be amazing.

Answer 1

Has anyone used a file hash to prove authenticity of a file during legal proceedings?

Yes, it's a routine step in Computer Forensics. But you really should read Law Is Not A Science: Admissibility of Computer Evidence and MD5 Hashes by Rob Lee. In short, don't expect waving a hash in court to prove anything - you need to present the story of the hash in a way that the court is comfortable trusting it.

If you're implementing a solution, think not in terms of the technology but in terms of what the court would need to know. That means logging the introduction of the file into your system, and then being able to prove tie a later-in-time copy of the file back to that original provenance. The hash is how you prove they are the same. Make sure the proper logging is in place to show who (user ID, IP address) uploaded the file (hash) when.

If "when" is important to your legal concerns, you should look into a Trusted Timestamping service - you provide the log entry with hash, someone timestamps and signs it, you can later get that verified to show that yes, really, you had hash adef01....42fc in hand on 7 June 2018.

Answer 2

If I understand your question, the process you want is the following:

Your client wants to upload a file to your service and obtain a proof that they have done so even if you, yourself, do not retain the original file. They want to prove that beyond reasonable doubt (which should cover your legal base).

Using a hash (especially not a weak one as MD5) is not enough: you need to add to the mix some kind of secret that you holds but that your client does not. Otherwise, he could easily forge that and therefore cannot prove his good will if challenged.

If my understanding of your situation is correct then a good solution should be for you to generate a digital signature of the file using a certificate yo own, including a secure timestamp, and send that information back to your user.

Once they have that digital signature block (and as long as your implementation is sound), either party can prove that, at the time of the upload, you received a copy of that file even if (or the other party) doesn't have it anymore.

Make sure you use a secure timestamp, though, or there won't be any valid indication when the signature was produced. In your shoes, I would also keep all the digital signatures yourself as well, even if you delete the files. If your customer uploads the same file twice, you will then be able to prove that fact yourself, even if they only produce one of the two generated signatures.

Edit: One possible failure of that system is that you could, in theory, sign the file a second time after it has been received. It means that you cannot prove that your client didn't upload the file more than once (since you could fake a new upload at any time of your choosing after you have received the file).

In any case, make very sure that you use a secure hash function, not MD5 because any weakness of the hash function will render the whole setup useless.