Chain of custody for video: what a manifest records and how to check it

A record of what existed, when, and whether it has changed.

Chain of custody is a record of who has held a piece of evidence and what happened to it. For video, the first links are created at the moment of capture, and they are the hardest to reconstruct later. This page covers what a useful record contains and what Witness writes. Written by the developer of Witness Camera, so read it with that in mind; where another approach is better, it says so.

Short answer. A chain-of-custody record for video should list each file, a fingerprint of it, when and where it was captured, and an independent proof of when the record itself existed. Witness writes a session manifest, a JSON file listing every 15-second piece with its SHA-256 hash, UTC start and end times and GPS coordinates with accuracy, and has the manifest independently time-stamped. It is rewritten and re-uploaded as recording continues, so a record exists even if the phone is taken. It covers capture. Custody after that, who copied the files and when, you must keep yourself.

What the organisation WITNESS says

The international human-rights organisation WITNESS, which is unrelated to this app, defines chain of custody as chronological documentation showing who has held or controlled a video file from the moment it was created, and treats an unbroken chain as an important indicator of authenticity. It also notes that hashes are a particularly important kind of metadata for evidentiary video. The Berkeley Protocol on Digital Open Source Investigations similarly stresses authenticity and chain of custody.

What Witness's manifest contains

Every chunk, with its SHA-256 hash.
Capture start and end times in UTC.
GPS coordinates with accuracy, if location was allowed. It is optional, and everything else works if declined.
Consolidated videos under mergedVideos, with their hashes.
The time-stamp authority used and a note on how to verify.

The manifest is rewritten and re-uploaded as the recording proceeds, overwriting the same file. A record therefore exists in your storage during the event, not only if the session ends normally. When the session finishes, a hash of the manifest is independently time-stamped.

What it does not cover

Custody after capture. Who copied the files, when, and to where. Keep that log yourself, and never edit the original.
What the footage shows. The record shows it is unchanged, not that it is a fair picture of events.
Location beyond GPS accuracy, which is recorded per chunk.

Checking it

Hash each video and compare with the manifest, then verify the time-stamp token. See how to verify footage, or the newsroom guide for the commands. Pro can also turn a finished recording into a PDF evidence report.

Questions

What should a video chain-of-custody record contain?

Each file, a fingerprint of it, when and where it was captured, and an independent proof of when the record existed. Witness's manifest holds the hashes, UTC times and location accuracy, and is time-stamped by an independent authority.

Is the manifest still written if my phone is taken mid-recording?

Yes. It is rewritten and re-uploaded as the recording proceeds, so the record of everything captured so far is already in your storage.

Does Witness record my location in the manifest?

If you allow location, yes, with accuracy per chunk. It is optional: if you decline, everything else still works.

Who is responsible for custody after the recording?

You are. The manifest covers capture. Keep a log of who copied or handled the files, and never edit the original.

Try it free

The free app includes this. Set it up and test it before you need it.

Get Witness Camera for Free Get it on Google Play

More Witness features explained

Written on 27 October 2026. Features and prices change. This is not legal advice.