Chain of custody and email integrity
Every completed investigation produces a Chain of Custody PDF, available from the Downloads tab. It is the legal record of what was searched, when, and by whom; keep it with your investigation files.
What it records
Who ran the investigation; when it was created and completed; which custodians were searched; the date range and keywords; proximity criteria (if set); the Google Vault export ID; which files were downloaded and their sizes; email counts (total, processed, errors); the SHA256 Email Manifest; the Analysis Model Versions; and a document integrity hash.
The SHA256 manifest
Every email collected by ScoopVault is fingerprinted at the moment it is received from Google Vault. A SHA256 hash is a 64-character string that uniquely identifies the exact content of a message: if a single character changes, even a space, the hash changes completely.
The hash is computed from the original raw bytes of each email, before any processing; this fingerprints the source, not a derived copy.
The Chain of Custody PDF includes a SHA256 Email Manifest listing every email with its date, sender, subject, and hash. For investigations with more than 500 emails, the first 500 are shown in the PDF and the full manifest is in the audit log CSV.
What it can prove
If anyone questions whether the emails have been altered, recompute the SHA256 from the original Vault export files and compare against the manifest. A match shows the emails are unchanged from the moment of collection. This recompute-and-compare property has been exercised end-to-end: in the most recent disaster-recovery test (2026-07-03), restored evidence was re-hashed via the ingestion code path and matched the manifest exactly across the full rehearsal corpus.
Historical investigations: investigations completed before June 2026 show "not captured" in the SHA256 column. The manifest is fully populated for all investigations run from June 2026 onwards.
Analysis model versions
The Chain of Custody PDF records which AI model versions were used to analyse the investigation (the scoring version and cases prompt version), so you can demonstrate exactly what AI logic was applied to produce the findings.
Can't find what you need? Contact support — we aim to respond within one business day, during UK business hours.