Is a photo admissible as evidence in court?

Yes, digital photos are regularly admitted as evidence, but their admissibility depends on establishing authenticity and chain of custody. The offering party must demonstrate that the image accurately represents what it claims to show and has not been altered since capture. Hash verification, metadata documentation, and forensic analysis reports support this foundation.

What hash algorithm should I use for evidence?

SHA-256 is the current standard for forensic evidence. MD5 and SHA-1 are considered cryptographically compromised and may be challenged in court. Always compute and record SHA-256 at minimum. Some organizations also compute SHA-512 for additional assurance. Record the hash immediately upon acquisition, before any analysis.

Digital Evidence: Preserving Photo Integrity for Legal Use

Q: Does opening a photo change its hash?

Simply viewing a photo in most applications does not change the file. However, some programs modify metadata on open — updating access timestamps, rotating based on EXIF orientation, or adding application-specific tags. Always work on copies, never originals. Verify the hash of the original remains unchanged after any operation.

Q: Can metadata prove when a photo was taken?

EXIF timestamps indicate when the camera recorded the image, but they can be falsified using metadata editing tools. Timestamps are supporting evidence, not proof. Corroborating evidence — GPS consistency with known locations, weather conditions matching the claimed date, camera serial number matching a known device — strengthens timestamp claims.

Q: Should I use cloud-based or local forensic tools?

For evidence handling, local (client-side) tools are strongly preferred. Uploading evidence to cloud services introduces third-party access, potential data logging, and chain-of-custody complications. Browser-based tools that process locally — like Scanly — provide forensic capabilities without transmitting the image. For formal proceedings, purpose-built forensic software with audit logging is recommended.

Why Integrity Is Everything

Digital photos are routinely used as evidence in legal proceedings — insurance claims, criminal investigations, civil disputes, workplace incidents, intellectual property cases. But unlike physical evidence, digital files can be silently modified without visible trace. A single pixel change, a metadata edit, a re-save — any alteration, no matter how small, raises questions about the file's reliability.

Try it free: File Hash Scanner — Generate SHA-256 hashes to verify file integrity. Runs in your browser, no signup needed.

This is why courts and legal frameworks emphasize two requirements for digital evidence: authenticity (the image is what it claims to be) and integrity (the image has not been altered since acquisition). Meeting both requires a disciplined process from the moment the evidence is acquired through its presentation in proceedings.

Step 1 — Acquire Without Altering

The first rule of evidence handling: never modify the original. This means never opening the original file in an editor, never renaming it, never moving it between folders on the source device if avoidable.

From a device: copy the file to a forensic workstation using a write-blocked connection or forensic imaging tool. On mobile devices, use established acquisition tools that extract files without modifying access timestamps.

From the internet: if the evidence is an online image, capture it with the full URL, page context, and timestamp. Use archival tools or browser-based capture. Screenshots lose metadata — download the original file whenever possible.

From messaging: images shared via WhatsApp, Telegram, or email have already been recompressed and metadata-stripped by the platform. Document this limitation. The platform-processed version is still evidence, but its forensic value is reduced compared to the original.

Step 2 — Hash Immediately

The moment you have a copy of the evidence file, compute its cryptographic hash — before any analysis, before any viewing, before any other operation. This hash becomes the reference point for the file's integrity throughout the case.

Use SHA-256 as the minimum standard. MD5 and SHA-1 are cryptographically compromised — practical collision attacks exist — and may be challenged in proceedings. Our File Hash Scanner computes MD5, SHA-1, SHA-256, and SHA-512 simultaneously, all client-side. For a detailed explanation, see our guide on how cryptographic hashing works.

Record the hash in your case documentation with the date, time, and the person who computed it. This entry establishes the baseline. Any future verification that produces the same hash confirms the file hasn't changed. Any different hash means the file was altered — even if the change is invisible.

💡 Did you know?

SHA-256 produces a 256-bit hash — one of 2²⁵⁶ possible values (approximately 10⁷⁷). The probability of two different files producing the same hash by chance is effectively zero. No practical collision attack against SHA-256 has ever been demonstrated.

Establish file integrity with SHA-256 — compute the hash instantly in your browser, no upload needed.

Compute File Hash →

Step 3 — Document Metadata

Extract and record the full metadata before proceeding with any analysis. Use the EXIF Checker to capture every field — camera model, lens, settings, timestamps, GPS coordinates, software tags, thumbnail presence, and any IPTC or XMP data.

Key fields for evidence:

Date/time original: when the camera recorded the capture. Cross-reference with the file system creation date and any external timeline evidence.
GPS coordinates: if present, verify they match the claimed location. Drop them into a map and check for plausibility.
Camera model and serial number: ties the image to a specific device. If the device is in evidence, compare serial numbers.
Software tag: reveals whether the image was processed after capture. "Adobe Photoshop" or "GIMP" indicates editing.
Thumbnail: camera-original JPEGs contain an embedded preview. If it doesn't match the main image, the photo was modified. Use the Thumbnail Scanner to check.

For metadata types and what each reveals, see our guide on EXIF, XMP, and IPTC metadata.

Step 4 — Forensic Analysis

Run the image through forensic analysis tools to check for manipulation. Work on copies — never the original file. Document every tool used, every setting applied, and every result obtained.

Authenticity check: automated multi-signal analysis covering metadata consistency, compression patterns, and software signatures.

Error Level Analysis: reveals locally edited or spliced regions through compression error patterns. See our ELA explainer.

JPEG ghost analysis: detects content composited from sources saved at different JPEG quality levels. Details in our ghost analysis guide.

AI detection: determines whether the image was generated by AI tools rather than captured by a camera.

Each analysis result should be saved (screenshot or export) and included in your documentation. The Batch Scanner can process multiple evidence images simultaneously, producing structured CSV/JSON exports suitable for case files. Read our complete guide to image forensics for technique details.

Step 5 — Maintain Chain of Custody

Chain of custody documents every person who handled the evidence and every action taken on it. For digital files, this means:

Log every access. Who opened the file, when, using what tool, for what purpose. Even viewing the file should be logged.

Work on copies. Create a forensic copy for analysis and keep the original untouched on write-protected storage. Verify the original's hash periodically to confirm it remains unchanged.

Use local tools. Uploading evidence to cloud-based analysis services introduces third-party handling — the service provider's servers have seen the image. This complicates the chain of custody and may raise admissibility concerns. Browser-based tools that process locally (like Scanly) avoid this problem because the image never leaves the analyst's device.

Store securely. Evidence files should be on encrypted storage with access controls. The storage medium itself becomes part of the chain — document its serial number, location, and access log.

Step 6 — Compare and Cross-Reference

If multiple copies of the same image exist — from different sources, different devices, or different points in time — compare them to establish the file's history.

Hash comparison determines if two files are byte-identical. Different hashes confirm the files differ — even if the difference is invisible. See cryptographic vs perceptual hashing for when to use each.

EXIF comparison diffs the metadata between two versions, highlighting changes in timestamps, software tags, or other fields that reveal the file's processing history.

Reverse image search checks whether the image (or earlier versions) exist elsewhere online, establishing provenance and identifying potential original sources.

🔍 Pro tip

Re-verify the original file's hash at every stage — after acquisition, after analysis, before presentation. If the hash changes at any point, the file was altered and you need to determine when and how. A consistent hash throughout the process is your strongest proof of integrity.

Common Pitfalls

Opening the original in an editor. Some applications modify metadata on open — updating access timestamps, rotating based on EXIF orientation, or embedding application tags. Always work on copies.

Using cloud analysis tools. Uploading evidence to a third-party server means the evidence left your custody. Document this if it happens, and prefer local tools for sensitive material.

Ignoring metadata limitations. EXIF timestamps can be falsified with tools like ExifTool. Metadata is supporting evidence, not proof. Always corroborate with independent sources — weather records, access logs, witness accounts.

Over-relying on screenshots. A screenshot of a photo is not the same as the photo. Screenshots strip metadata, recompress the image, and introduce the screenshot device's characteristics. If the original file is available, use it.

Failing to document the analysis process. A forensic result is only valuable if you can explain how you obtained it, what tools you used, and why your interpretation is valid. Document every step.

Common Questions

Is a photo admissible as evidence? Yes. Digital photos are regularly admitted, but admissibility requires establishing authenticity and chain of custody. Hash verification, metadata documentation, and forensic reports support this foundation.

What hash algorithm for evidence? SHA-256 minimum. MD5 and SHA-1 are compromised and may be challenged. Compute SHA-256 immediately upon acquisition. Some organizations also compute SHA-512.

Does opening a photo change its hash? Most viewers don't modify the file. But some programs update metadata on open. Always work on copies and verify the original's hash remains unchanged.

Can metadata prove when a photo was taken? EXIF timestamps indicate capture time but can be falsified. They're supporting evidence, not proof. Corroborate with GPS consistency, weather records, and device identification.

Cloud or local tools? Local tools strongly preferred for evidence. Cloud services introduce third-party access and chain-of-custody complications. Browser-based tools that process locally avoid both issues.

The Hash Never Lies

Digital evidence is fragile — one careless operation can compromise its integrity and admissibility. But the process for preserving it is straightforward: acquire without altering, hash immediately, document everything, analyze on copies, maintain the chain, and verify the hash at every stage. The SHA-256 hash is the anchor — an immutable mathematical proof that the file you're presenting is exactly the file you acquired. Start every evidence workflow with the File Hash Scanner, and build your analysis from there using the 6-step verification workflow.