Files on their own prove nothing. What makes them evidence is a person saying where they came from, how they were copied, when, and that these exact files are what was taken, with a hash against each one. This writes that certificate in three of the forms usually asked for, hashes every file here in your browser, and refuses to produce a certificate with a hole in it.
Every file is read here to take its SHA-256. Nothing is uploaded, and the files themselves are not kept.
Drop the files here, or
The hash is what is being certified. SHA-256 is computed over the whole of each file, here in this tab. Change one byte and the digest is different, so the certificate ties the signature to these exact files rather than to a folder name. The files are read to hash them and are not kept or uploaded.
Three forms, because three are asked for. A copy certificate for data taken from a device or an account, in the shape United States Rule 902(14) expects. A records certificate for records kept in the ordinary course of a business, for 902(11) and (13). A plain statement of truth for jurisdictions that want a statement rather than a certificate.
It will not let you leave a gap. Each form has fields it cannot be signed without: who you are, what the material came from, how it was copied or how the records are kept, and the date. Ask for it half-finished and it tells you what is missing instead of printing it.
The hash list is a separate file on purpose. It is written in the plain sha256sum form, so anyone can check the files with the tool already on their machine rather than taking your word for it. Keep it beside the files.
It is not legal advice. Whether a certificate is accepted, what your jurisdiction requires it to say, and who is qualified to sign it are legal questions this page does not know the answer to. It writes the document; the judgement is yours.
In United States federal practice, a certificate by a qualified person that data copied from an electronic device or account was copied by a process of digital identification, meaning hashing. It lets the copy be admitted without calling a witness to authenticate it. Other jurisdictions have their own near-equivalents, which is why the plain statement form exists.
No. Each file is read by this tab, its SHA-256 computed in the browser, and only the name, size, last-modified time and digest are kept. The contents never leave the machine, which is why the page works with the network off.
Yes, and you should. Download the hash list and run sha256sum -c on Linux, shasum -a 256 -c on macOS, or Get-FileHash in PowerShell. Matching digests from a tool you chose are worth more than matching digests from ours.
Say so in the certificate rather than silently leaving them out. The notes field is there for that, and PRIVLOG will give you the log to point at.
No. It produces the document, printable, for a human to sign. A digital signature, where one is wanted, is applied with your own key and your own signing tool; SEAL and PROOF cover the file-level side of that.