Research overview
Abstract
A suspected infringement is easier to review when its source, observation time, supporting material and decision history remain connected. Screenshots and isolated URLs often lose that context as they move between tools. This paper proposes an evidence workflow that treats captures, transformations and reviewer decisions as distinct, linked records. The research examines whether structured manifests and integrity checks can improve packet completeness, reproducibility and correction handling without collecting more material than necessary. We describe a proposed record model, controlled capture process, versioning scheme and prospective evaluation. The approach supports technical traceability; it does not assume that a checksum proves authenticity, that a screenshot proves ownership or that a structured packet is automatically admissible in every legal setting. No validation results are reported.
Research questions
- Can a reviewer reconstruct a case from a packet without relying on undocumented operator knowledge?
- Which integrity checks detect accidental changes without overstating what they prove?
- How should corrections, withdrawals and expired access be represented over time?
1. Evidence quality begins with a reconstructable observation
An image of a page may show relevant material but omit the URL, the capture conditions or the moment of observation. A URL can identify a location without preserving what was visible there. A case assembled from disconnected items therefore depends on the memory of the operator who collected them. That dependence becomes a practical problem when the source changes or another person needs to review the case later.
Our proposed research objective is reconstructability: an authorized reviewer should be able to distinguish what was observed, what was inferred and what was subsequently decided. Reconstructability is narrower than proving a legal claim. It asks whether the technical record supports an accurate account of the collection and review process, including missing information, conflicting observations and changes made after the first capture.
2. A provenance model for artifacts and decisions
The W3C PROV model provides a vocabulary for relating entities, activities and responsible agents. We use this as a conceptual foundation for a proposed case graph: a capture is an entity, collection is an activity and the collecting system is an agent in the provenance sense. Derived crops, transcripts and comparison results should refer to the artifact and process that produced them rather than appear as unexplained attachments.
A decision record is a separate entity with its own author, time, scope and evidence version. This distinction lets a reviewer revise a conclusion without rewriting the earlier observation. It also makes it possible to ask a precise question about a report: which reference, capture and authorization state were available when it was approved? The proposed graph should answer that question without implying that every linked artifact is equally reliable.
Source context: [1]
3. Proposed capture and manifest architecture
The capture stage should produce a manifest containing the case identifier, original source reference, retrieval result, observation time, collection method and artifact identifiers. The manifest should also record relevant limitations, such as a failed embedded player or material that was not accessible. A collection failure should remain visible instead of being replaced by a successful-looking screenshot from a different page.
Original artifacts should be stored separately from derived review material. A crop can help a reviewer inspect a relevant detail, but the surrounding context may be needed to interpret it. We propose retaining the relationship between those views and presenting a concise packet index that explains each artifact's purpose. Access can then be granted to the narrow set of materials required for the review rather than to an unrestricted collection directory.
A linked evidence record preserves context
The source observation, captured artifact, derived material and reviewer decision have distinct roles.
- 01Observe
Record source, time and collection conditions.
- 02Preserve
Store the original artifact and its digest.
- 03Derive
Link crops, transcripts and comparisons.
- 04Review
Attach decisions to the version inspected.
4. Integrity checks and their limits
A cryptographic digest can help detect whether an artifact differs from the bytes against which a recorded digest was calculated. The Secure Hash Standard documents algorithms used for this purpose. In the proposed workflow, digests support transfer checks, duplicate detection and controlled verification of stored artifacts. They should be accompanied by a record of when and how they were created.
A matching digest does not establish that the original capture was truthful, that its clock was correct or that the collecting party owned the relevant rights. An attacker or mistaken operator could hash the wrong file perfectly. We therefore propose evaluating integrity, source context and decision authority as separate properties. A tamper-evident history is useful only within a defined trust model and should not be marketed as an automatic proof of authenticity.
Source context: [2]
5. Time, versioning and correction handling
Time records should distinguish the source's stated publication time, the observer's capture time and the time a case was reviewed. These timestamps answer different questions. We propose recording time zones and relevant clock uncertainty, especially when observations arrive from different systems. An event received late should not be placed into a timeline solely by arrival order if the original observation time is available.
Corrections should create a visible successor record. If a reviewer discovers that a clip was official publicity, the revised decision should identify the evidence and scope of the correction. Previous reports may need separate follow-up depending on their state. The proposed system should make that sequence inspectable while restricting access to superseded personal or confidential data according to the applicable retention rules.
6. Proposed packet-completeness and reconstruction study
We propose constructing authorized example cases with known source conditions and deliberate variations in record completeness. Some packets would contain a full manifest, others an omitted source detail, a changed derivative or a mismatched reference version. Independent reviewers would reconstruct each case using only its packet. Their explanations would be compared with the documented fixture history, not with the confidence of the system that created the packet.
The evaluation should measure missing context, incorrect reconstruction, time to locate a supporting artifact and the effort needed to correct a case. Integrity tests can introduce controlled byte changes, swapped attachments and interrupted transfers. These tests should distinguish detection of a changed artifact from identification of who changed it. A useful result would explain which record fields prevented errors and which added administrative work without improving review.
Test reconstruction and correction
The evaluation asks independent reviewers to reconstruct cases while controlled changes probe integrity and version handling.
- 01Build fixtures
Create authorized, documented example cases.
- 02Vary records
Introduce missing context and changed artifacts.
- 03Reconstruct
Have reviewers explain each case from its packet.
- 04Assess
Measure omissions, changes and correction effort.
| Property | Test | What it does not establish |
|---|---|---|
| Integrity | Recalculate a digest after controlled changes | Truthfulness of the initial capture |
| Completeness | Reconstruct a case from its packet | Correctness of the rights assertion |
| Traceability | Follow a derivative to its original and process | Legal admissibility in every jurisdiction |
| Correctability | Revise a decision without losing its history | Automatic reversal by an external platform |
7. Access, retention and external disclosure
A case packet may contain unrelated personal information, private release details or contractual material that should not be copied into a public report. We propose classifying artifacts by purpose and separating internal review records from material prepared for a specific recipient. The external packet should contain the information needed for that process and should not automatically include every internal note or collected attachment.
Retention should be based on an explicit purpose and review schedule. The system needs a way to remove or restrict an artifact while retaining an appropriate record that a change occurred. This creates a research tradeoff between historical reconstruction and data minimization. We propose testing redacted and synthetic research fixtures so that workflow experiments do not require distributing live client evidence to development or demonstration environments.
8. Reproducibility and research progression
A reproducible study should publish the manifest schema, fixture-generation process, integrity-test conditions and reviewer instructions. The schema should be versioned, because changing the meaning of a field can make old packets appear complete when they were collected under a different rule. We propose evaluating migration procedures alongside new record features so that improvements do not break the interpretability of historical cases.
The next phase should compare a structured packet with the simpler file-and-spreadsheet workflow it is intended to improve. Reviewers should evaluate both under equivalent case conditions, including corrections and incomplete access. A later operational study can examine whether the additional structure improves handoffs between discovery, review and reporting teams. Any claim of legal suitability would require a separate assessment of the intended process and jurisdiction.
Research position
Conclusion
Technical evidence becomes more useful when its context, transformations and review history can be reconstructed. This paper proposes a provenance-aware packet design and an evaluation focused on real review tasks. Integrity checks are one component of that design, not a substitute for trustworthy collection or verified rights. Future results should report both the errors prevented and the operating burden introduced by the added structure.
References & technical foundations
External research and specifications provide context for the proposed methods. They do not independently validate this team's design or imply endorsement.