Are Your Digital Documents Authentic? Here’s How To Check.  (2024)

Takeaway: Verify a document is authentic by examining its (1) digital signature, (2) metadata, (3) hash value, and (4) chain of custody.

Most documents nowadays are digital. So, how do we know they haven’t been tampered with?

Digitization of documents has revolutionized the legal world and the lives of lawyers, particularly those at small and midsize firms. But with this digitization comes a challenge: How do we establish that a digital document (PDF, Word document, spreadsheet, etc.) is authentic? And this question becomes even more important in the context of data breaches and document tampering we regularly hear about. Luckily, there are things we can do to ensure we’re dealing with authentic data.

1. Check your document’s digital signature.

A digital signature is a mathematical creation (a ‘scheme,’ to be precise) that ‘proves’ a digital message or document is authentic. It’s similar to a handwritten signature but way more secure. Some examples of digital signal protocols include PKCS#7, X.509, and Digital Signature Algorithm (DSA).

Here’s how digital signatures work.

1. Key Pairs. Digital signatures use a pair of keys: a public key and a private key. The signer keeps the private key confidential while the public key is shared openly and available to anyone. (Note that it's crucial to protect this private key. If that gets leaked, the document automatically becomes compromised.)
2. Signing the document. When someone digitally signs a document, a cryptographic hash is created. I.e., a string of letters and numbers derived from the document’s content is generated. This hash is then encrypted with the signer's private key to create the digital signature.
3. Verification: When recipients receive the signed document, they can decrypt the signature using the signer's public key. They also generate a new hash from the received document. If this newly generated hash matches the decrypted hash from the signature, the document is verified as genuine and untampered with.

2. Explore the document’s metadata.

Metadata, often described as "data about data," provides context about the content, quality, condition, origin, and other characteristics of a document or piece of data. It lives behind the scenes and offers a roadmap to understand and work with the data more efficiently. For instance, administrative metadata provides information about when and how a document was created, details about licenses and rights, and more. (Note that there are other types of metadata. For example, descriptive metadata reveals a document’s title, author, keywords, etc. Structural metadata covers things like how pages are ordered to form chapters in a book. And geospatial metadata confirms where a document was created.) Learn more about metadata.

3. Verify a document’s hash value.

Earlier, we mentioned hash values in the context of digital signatures. But you can create a hash value independently, too. As a reminder: a hash value, often called a hash, is a fixed-size string of letters/numbers generated from input data. And this string serves as an identifier for the document. Crucially, even the smallest change in the input data (e.g., deleting a single word from a document) will produce a drastically different hash value. This makes hashes perfect for security and integrity checks. For example, when sending a document, you'd provide the document's hash value to the recipient, who would then recalculate the hash to see if it matches yours. Common hash functions include MD5 (Message Digest Algorithm 5) and SHA-1 (Secure Hash Algorithm 1). Do note that while it's highly unlikely for two documents to have the same hash value, it's not mathematically impossible. So, hashes are especially great when combined with other security measures like digital signatures.

4. Inspect a document’s chain of custody.

A chain of custody refers to the digital ‘trail’ tracking when a document is collected, used, analyzed, and transferred. It’s a way of logging who handles and stores a document right from when it was collected to when it was presented in court.

The chain of custody matters for a bunch of reasons.

1. Integrity and authenticity: The chain of custody ensures that evidence has been handled properly and hasn't been tampered with or altered in any unauthorized manner.
2. Legal admissibility: For evidence to be admissible in court, the chain of custody must be intact. Any breaks or uncertainties can compromise a document.
3. Accountability: It creates a documented pathway, establishing accountability for anyone who handles the evidence.

Here’s what goes into establishing a chain of custody.

1. Collection: Properly identifying, labeling, and recording the evidence at the point of collection. This might involve making a forensic copy of a hard drive, capturing network logs, or downloading emails. It's crucial that this process doesn't alter the original data.
2. Transportation: Ensuring that evidence is shared securely, minimizing the risk of tampering, loss, or contamination.
3. Storage: Safely housing evidence in secured digital storage. Electronic evidence is often stored in encrypted containers or drives, ensuring unauthorized users cannot access or alter it.
4. Analysis: If evidence undergoes any form of analysis or examination, this process, along with its results and the individuals involved, must be thoroughly documented. (Modern systems keep access logs detailing who accessed the evidence, when, and what operations they performed. We can even use hash values to verify that digital evidence remains unaltered throughout its lifecycle.)
5. Transfer: If evidence is transferred between individuals or locations, every handoff must be documented. This includes the date, time, reason for transfer, and the identities of the parties involved.
6. Disposition: This details the final status of the evidence, whether it's returned to its owner, destroyed, retained for future proceedings, or archived.

We have to look out for common challenges, though.

1. Breaks in the chain: Any gaps or uncertainties can compromise a document’s integrity, making it legally inadmissible.
2. The volume of digital evidence: With so many electronic devices producing vast amounts of digital data, it’s becoming harder to maintain a robust digital chain of custody.
3. Training and awareness: Properly maintaining a chain of custody requires training and awareness, ensuring every individual in the chain understands their responsibilities.

In conclusion, verifying documents might take effort, but it’s possible with the right approach.

The stakes for verifying the authenticity of digital documents have never been higher. But with the right knowledge and tools, you can make technology work for you instead of against you. So, mix the above techniques into your eDiscovery workflow, and rest assured you’re dealing with genuine, untampered evidence.