How a Provena record is made.
This page describes the method end to end — for the lawyer who has to defend the record, the expert who has to examine it, and the decision-maker who has to weigh it. Every claim here is reflected in the product and checkable in the record itself.
Four commitments, one method.
Capture happens in a dedicated remote browser operated by the platform, with a server-enforced interaction policy — never on the operator's machine, never subject to their local browser state.
Every file is fingerprinted the moment it exists, checked again after every transfer, and only stored when the values match. Alterations don't get hidden — they get detected.
Every step — allocation, capture, transfer, sealing, access — is appended to a hash-linked chain as it happens, never reconstructed afterwards. The chain itself can be re-verified independently.
The sealed record's fingerprints are registered with independent public networks and time-stamp authorities, so its existence can be confirmed without relying on us.
The process is informed by the principles of ISO/IEC 27037 for the identification, collection, and preservation of digital evidence. Provena does not claim formal certification under that or any other standard.
From session to sealed record.
The demo session's 135 custody events condense into eight stages. Each one leaves events in the chain — nothing below is taken on faith.
-
01
Session created. Label, initial URL, resolution, locale, and timezone recorded up front; capture limits resolved from organization policy.
-
02
A dedicated worker allocated. One isolated remote browser per session, created for the occasion and destroyed afterwards — WORKER_ALLOCATED is itself a custody event.
-
03
Evidence generated as you work. Screenshots with a provenance mark rendered into the pixels, video, files, page snapshots, and technical logs.
-
04
The integrity gate. Files are hashed at origin, transferred, hashed again at destination, and written to storage only when the values match — INTEGRITY_VERIFIED, per file.
-
05
Package sealed. Every approved file plus the manifest inventory consolidated into one plain ZIP; its final SHA-512 fixed and recorded as PACKAGE_SEALED.
-
06
Working copies deleted, custody sealed. Only after completion and recorded local deletion is the material chain closed with CUSTODY_SEALED — the deletion itself is on the record.
-
07
External proofs registered. The package hash and the custody seal — each anchored with independent providers: public blockchain networks, OpenTimestamps on Bitcoin, RFC 3161 time-stamp authorities.
-
08
Report, review, verification. The record becomes readable — online and as an archival PDF — and checkable: by code, by file, by chain, by external reference. Access itself joins the chain as events.
Fingerprints, chained.
Everything reduces to one honest mechanism: cryptographic fingerprints (SHA-512), computed early, compared often, and chained so that history can't be quietly rewritten.
- One canonical fingerprint, SHA-512, for files, the package, and every custody event — with SHA-256 and SHA3-512 computed for files as supplementary references.
- Every event points to the previous one by hash. Changing, removing, or reordering any past event breaks every link after it — visibly.
- The recipe is public: each event ships the exact text that was hashed, so any reviewer can recompute the whole chain without asking Provena for anything.
What this methodology does not claim.
A method that wants to survive scrutiny states its own boundaries. These are ours — the same ones printed in every report's scope statement and threat model.
Provena preserves what was observed during the session and supports the integrity and chronology of that observation — not the truthfulness, lawfulness, or authority of the third-party content itself.
Admissibility depends on jurisdiction, procedure, and the decision-maker's assessment. Provena provides technical elements that support that analysis.
The model detects alteration — it does not claim alteration is impossible. If the chain doesn't reproduce, the break is visible and locatable.
External proofs registered in mock or sandbox environments demonstrate the workflow only, and are labeled as such. Only production-confirmed anchors count as external proof.
The method is the product. Examine both.
Every report carries this methodology inside it — along with the scope statement, the threat model, and the audit guide to check everything said here.