How to Preserve Deepfake Digital Evidence

Preserve first, analyze second

A suspected deepfake can arrive as a camera file, email attachment, social-media post, disappearing message, voice note or screen recording. Each route preserves different information. Opening, forwarding, exporting, transcoding or uploading the only copy may change metadata, filenames, timestamps or media encoding before anyone has documented the source.

Make the best available original read-only in practice: copy it into controlled storage, limit access and do not edit it. Create a separate working copy for playback, frame extraction, enhancement and detector submissions. SWGDE’s digital-video guidance recommends analysis on a working copy and comparing hashes of the submitted item and working copy so changes can be identified.

This guide is a practical collection checklist, not a substitute for a forensic examiner, legal hold or jurisdiction-specific evidence procedure. If the material may support litigation, criminal reporting, employment action or another high-impact decision, involve qualified legal and forensic staff early. They may need provider records, a device acquisition or a preservation request that an ordinary download cannot supply.

Collect the most original file that is realistically available

Ask the sender or custodian for the native export rather than a screenshot, edited clip or file played back and recorded from a screen. Preserve the received filename and extension. If an application offers ‘save’, ‘download original’ and ‘export’ options, document which one was used; they may produce different media and metadata.

For email, keep the original message with full headers and the attachment, not only a forwarded copy. For a messaging platform, preserve the conversation context, account identifier, message time and export method alongside the media. For a public post, capture the full URL, account or channel, visible publication time, caption, surrounding thread and the time you collected it.

Download cloud-hosted evidence promptly when authorized because links and posts can expire, change or disappear. SWGDE notes that third-party download links may be time-sensitive and recommends retaining a static local copy, the source and the original email or complete link. A screenshot helps document appearance and context, but it normally does not replace the underlying file.

• Native media or the closest available export
• Original message, email headers or full source URL
• Account, profile, channel and message identifiers
• Displayed time, collection time and relevant time zone
• Caption, thread, meeting invite or accompanying request
• Exact acquisition method, device and application used

Hash the collected file, but understand what the hash proves

A cryptographic hash is a repeatable fingerprint calculated from the file’s bytes. Record a modern hash such as SHA-256 immediately after collection, then calculate it again when a working copy is created, transferred or retrieved. Matching values support the claim that the bytes did not change between those points.

A hash does not prove that the depicted event is real, that a file came from the claimed camera or that it was unedited before collection. It establishes fixity from a documented point in the evidence lifecycle. That distinction prevents a common overstatement: ‘the hash matches’ means ‘this copy is unchanged relative to the hashed copy’, not ‘the content is authentic’.

Store the algorithm, value, filename, size, collection time and person or system that calculated it. SWGDE’s collection guidance recommends an acquisition hash, a verification hash, an archive and a working copy; its archiving guidance calls for fixity checks on ingest, retrieval and transfer. If a provider supplied its own hash or digital signature, retain and verify that information rather than replacing it with an undocumented screenshot.

Create a simple, contemporaneous chain-of-custody record

Chain of custody is the chronological record of where evidence was, who controlled it and what happened to it. Start the record at collection, not days later. Give the item a case and evidence identifier, describe it without assuming authenticity, and record every transfer, copy, analysis and change in storage location.

Notes should be specific enough for another person to reconstruct the collection. Include the source, date and time, time zone, device, application, account, export steps, filename, byte size and hash. Record who received access, why, when it ended and which working copy or derivative they used.

Do not silently correct a mistaken filename, clock setting or note. Preserve the original entry and add a dated correction. Contemporaneous documentation is more credible than a polished narrative assembled after a dispute, and it makes ordinary handling errors easier to identify without implying deliberate tampering.

• Case ID and unique evidence item ID
• Neutral description of the item and source
• Collector, date, time and time zone
• Filename, size, hash algorithm and hash value
• Storage location and access restrictions
• Every transfer, working copy, derivative and analysis
• Tool, version, settings, operator and generated output

Keep originals, working copies and derivatives separate

The original collection should remain unchanged. Name working copies and derivatives so they cannot be confused with it, and maintain a link back to the source item and hash. A frame export, audio extraction, stabilised clip, enhanced image, transcript and compressed review copy are all new evidence objects with their own creation step.

Document every transformation in order, including the tool, version, command or settings and output hash. SWGDE’s video-analysis guidance says processing should occur on a working copy and be documented so that it can be reproduced and independently evaluated. Unnecessary conversion should be avoided because transcoding can change visual appearance, timing, metadata and the signals used by automated detectors.

If a proprietary player forces a screen capture, record the source player, playback settings, display resolution, capture software, frame rate and any known differences. Label the result as a screen recording, not the original video. When native media later becomes available, preserve it as a new higher-quality source rather than overwriting the earlier collection.

Preserve detector results as observations, not verdicts

Before uploading a working copy, review the service’s confidentiality, retention, deletion and model-training terms. Sensitive faces, voices, identity documents, intimate imagery, trade secrets or privileged material may require an approved enterprise environment or an offline examiner. Do not use a public tool merely because it is fast.

Record the submitted evidence ID and hash, service, model or ruleset version, date and time, account or workspace, input settings, output score, threshold, warnings and complete exported report. Preserve screenshots only as a supplement when a stable report is unavailable. If the service changes its model later, the original result should still identify what produced it.

A result such as ‘likely synthetic’, ‘likely authentic’ or ‘inconclusive’ is an analytical observation. It does not by itself establish who created the file, whether anyone intended deception or whether the underlying event occurred. Compare model signals with provenance, metadata, source history, known originals, witness accounts and other case evidence.

Treat online context and platform metadata as separate evidence

The same bytes can appear in many posts with different claims. Preserve the publication context separately from the media file: URL, account, caption, thread, reactions relevant to the investigation, ad or post identifier and collection time. If a page changes, the preserved file hash does not describe that change.

Platform download times are not necessarily creation times. SWGDE’s cloud guidance warns that timestamps can reflect a download, sync or provider process rather than the user’s original activity, and that cloud systems may store time in different zones. Record what the timestamp field is called and where it came from instead of silently interpreting it as capture time.

For serious matters, ask counsel or an investigator whether the platform or service provider should receive a formal preservation request. A user-facing export may omit account logs, prior versions, access history, IP records or other data that a provider can retain or produce through an authorized process.

A first-response evidence kit for teams

Prepare the folder structure, evidence log and instructions before an incident. The person receiving a suspicious file should know where to place the protected collection, how to create a working copy, who may approve an external upload and how to reach legal, security or a forensic examiner. Avoid improvising a new cloud folder or forwarding chain during a crisis.

Test the process with ordinary non-sensitive files. Confirm that hashes are recorded, permissions work, logs survive export and a second reviewer can reproduce an analysis from the documented working copy. Include deletion and retention checks for any external service used during the exercise.

Escalate when the best available source is a device, disappearing message, live call, proprietary surveillance system or cloud account; when intimate or child-safety material is involved; or when the outcome may affect liberty, employment, significant funds or reputation. Preserving too little at the start can be irreversible, while a qualified examiner can choose a proportionate acquisition method.

• Protected original-evidence location with restricted access
• Working-copy and derivative folders with clear naming
• Hashing procedure and evidence-log template
• Approved detector and external-upload policy
• Legal hold, platform preservation and reporting contacts
• Qualified forensic escalation route
• Periodic access, fixity and retention review