What is a legal evidence pack for a document?
A legal evidence pack is a single self-contained bundle holding a document plus everything needed to prove it is what it claims to be: the document itself in an archival format, a cryptographic hash of it, a trusted timestamp, an audit trail of every action taken on it, and a manifest that seals both the individual files and the set as a whole. Its purpose is that a third party can verify it without access to the system that produced it.
The test an evidence pack has to pass
There is one question that decides whether a bundle is evidence or just a folder: can somebody who does not trust you, and has no access to your systems, verify it?
If verification requires logging into your platform, or requires your vendor’s tooling, then what you have is your vendor’s assertion rather than evidence. That is the failure mode worth designing against, because it only shows up at the moment the material is needed, which is usually years later and often during a dispute.
What goes in
The document, in an archival format. PDF/A is the ISO standard for long-term preservation; it strips features that could make a file render differently in future readers. PDF/A-3 specifically permits arbitrary file attachments, which is what lets the evidence travel inside the same container as the document.
A cryptographic hash of the document. A fixed-length fingerprint, SHA-256 or SHA-384. Any change to the file produces a completely different value. This is what makes tampering detectable rather than merely prohibited.
A trusted timestamp. An RFC 3161 token binding that hash to a moment attested by a third party. Without it, every date in the pack is a date you produced yourself.
An audit trail. Every action taken on the document: what happened, who did it, when, and from where. Written append-only, with each entry chained to the hash of the previous one, so that removing an entry in the middle breaks the chain rather than leaving a tidy gap.
A manifest that seals the set. This is the part most bundles get wrong. Hashing each file individually proves each file is intact, but not that the collection is complete. Someone can remove an inconvenient file and the remaining hashes still check out. A manifest hashes both the individual files and the set, so that an omission is as detectable as an edit.
The verification material. Certificate chains and revocation status as they were when the timestamp was issued. Certificates expire, authorities shut down, and revocation responders stop answering. Collect this at creation time, because it cannot be reconstructed later.
What it proves
An evidence pack proves that a specific content existed at a specific time and has not changed since, and that its handling is accounted for. A backup answers “do we still have it”. An evidence pack answers “can we prove what it was”.
Where SealDoc fits
SealDoc produces an evidence pack per document, on request: a PDF/A-3B file validated against ISO 19005-3, the RFC 3161 timestamp token that SealDoc requests by default, a SHA-384 hash chain, a chain-of-custody record, and a manifest that seals both each file and the whole set. It exports as a single download, and it is designed to be verifiable without SealDoc.
Last reviewed: