Chain of custody and email integrity

Who ran the investigation; when it was created and completed; which custodians were searched; the date range and keywords; proximity criteria (if set); the Google Vault export ID; which files were downloaded and their sizes; email counts (total, processed, errors); the SHA256 Email Manifest; the Analysis Model Versions; and a document integrity hash.

Every email collected by ScoopVault is fingerprinted at the moment it is received from Google Vault. A SHA256 hash is a 64-character string that uniquely identifies the exact content of a message: if a single character changes, even a space, the hash changes completely.

The hash is computed from the original raw bytes of each email, before any processing; this fingerprints the source, not a derived copy.

The Chain of Custody PDF includes a SHA256 Email Manifest listing every email with its date, sender, subject, and hash. For investigations with more than 500 emails, the first 500 are shown in the PDF and the full manifest is in the audit log CSV.

If anyone questions whether the emails have been altered, recompute the SHA256 from the original Vault export files and compare against the manifest. A match shows the content is unchanged since the manifest hashes were recorded.

Historical investigations: where a hash was not captured, the SHA256 column shows "not captured" rather than implying an integrity comparison is available.

The Chain of Custody PDF records which AI model versions were used to analyse the investigation (the scoring version and cases prompt version), so you can demonstrate exactly what AI logic was applied to produce the findings.