Overview#
The Evidence Upload Management module treats evidence ingestion as a security and forensic boundary, not merely a file transfer: every incoming file is validated against its format specification, screened for malware with fail-closed enforcement, hashed for cryptographic integrity, and catalogued with automatically extracted metadata before being admitted to the evidence store and opening its chain of custody record.
The first moment evidence enters a digital system is also the moment its chain of custody begins. A forensic examiner imaging a seized laptop, a field officer submitting photographs from a scene, or a prosecutor uploading a set of disclosed documents: each of these is the origin point of a record that may eventually be scrutinised in court. If the ingestion process loses metadata, fails to verify file integrity, or admits files without formally initialising the custody record, those gaps are very difficult to close later. The chain of custody record therefore opens at the moment of admission, timestamped and signed, covering every subsequent action the file experiences. Forty-plus file formats are supported natively, and large forensic images arrive through chunked transfer handling.
Key Features#
- Support for 40+ file formats with automatic format detection and compliance validation at the point of submission
- Multi-source upload channels accepting evidence from field devices, forensic workstations, cloud extractions, and external agency transfers
- Cryptographic integrity verification: SHA-256 hash computed at ingestion and locked into the chain of custody record before the file reaches storage
- Automated metadata extraction from file headers, EXIF data, document properties, and embedded attributes, eliminating manual cataloguing for most common formats
- Large file support with chunked upload handling for forensic disk images and multimedia files that would otherwise time out
- Chain of custody initialisation triggered automatically at the moment of ingestion, with no manual step required to open the custody record
- Mandatory, fail-closed malware scanning during ingestion: if the scanner cannot answer, the upload is rejected rather than admitted unscanned, and any file that fails a security check is routed to quarantine
- Decompression-bomb protection for archive uploads, measuring the true decompressed size during extraction and enforcing hard limits so a small archive cannot expand into an oversized payload
- Content-versus-declared-type verification: every uploaded file's declared media type is double-checked against its actual content at the server boundary, so a file renamed to masquerade as another format is rejected
- On-device content verification before upload from the mobile app: real content signatures are checked for JPEG, PNG, WebP, and the MP4, MOV, and HEIC family, with mismatched files rejected and removed from the device and a clear rejection message localised in English, Spanish, and French
- Batch upload capability for large collections with per-item status tracking and error reporting
- Upload progress tracking with detailed error messages and automatic retry support for interrupted transfers
Use Cases#
- Ingesting evidence from multiple sources with automatic format validation, integrity verification, and metadata extraction in a single end-to-end workflow
- Uploading large forensic images and multimedia files with chunked transfer handling and integrity verification
- Batch-uploading the contents of seized devices with automatic cataloguing and chain of custody initialisation per item
- Ensuring every piece of evidence that enters the platform immediately has a formally opened custody record, with no gap between ingestion and documentation
- Accepting evidence uploads from the public or partner agencies with fail-closed screening, so malware risk does not scale with the openness of the submission channel
- Catching disguised or corrupted captures at the point of collection on field devices, before they reach evidence storage or open a chain of custody record
Integration#
The Evidence Upload Management module connects with evidence storage, chain of custody, malware scanning, and metadata extraction services. Device-side content verification in the mobile app complements the server-side checks, with the client reporting accurate size and type so the backend can enforce its own limits independently. The surrounding sign-in endpoints also apply per-IP rate limiting to blunt credential-stuffing campaigns against the operator accounts that submit evidence.
Open Standards#
- SHA-256 (FIPS 180-4): Every file is hashed with SHA-256 at the moment of ingestion; the digest is locked into the chain of custody record before the file reaches storage, providing tamper-evident integrity verification.
- AES-256-GCM (FIPS 197): Admitted evidence files are encrypted at rest using AES-256-GCM, ensuring confidentiality and authenticated encryption of all stored material.
- RFC 3161 (Internet X.509 PKI Time-Stamp Protocol): Evidence exports can be anchored to an external Trusted Timestamping Authority via RFC 3161 tokens, producing a cryptographically verifiable proof of existence at a point in time.
- W3C Verifiable Credentials Data Model v2.0: A signed Verifiable Credential of type EvidenceCollection is issued for each evidence item at ingestion, serialised as a compact JWT with an Ed25519 signature, and used to assert provenance and support custody transfers.
- EXIF / ISO 12234-2 (JEITA CP-3451): Automated metadata extraction reads EXIF tags from image evidence, recovering device make and model, capture timestamps, GPS coordinates, and camera settings without manual cataloguing.
- ISO 19005 (PDF/A-1B / 2B / 3B / 4F): Evidence packages exported for court use can be rendered as PDF/A archival documents conforming to the applicable ISO 19005 part, ensuring long-term reproducibility and acceptance under legal disclosure rules.
- IANA Media Types / MIME (RFC 2045, RFC 2046): Each uploaded file is classified against its IANA media type at the validation boundary, and the declared type is verified against the file's actual content signature on both the device and the server; MIME type drives format compliance checking, OCR eligibility, thumbnail rendering, and export handling across 40-plus supported formats.
Last Reviewed: 2026-07-16 Last Updated: 2026-07-16