Engine Technical
Design Document

If evidence is not cryptographically sealed at the moment of capture — on the device, before it enters any network — then every subsequent claim about authenticity rests on trust rather than mathematics. Vault eliminates trust from the equation. Every file is simultaneously hashed with three algorithms: SHA-256 (current federal standard), SHA-3-256 (NIST post-quantum-resilient standard), and BLAKE3 (performance-critical streaming). The triple-hash approach provides algorithm-diversity resilience: if any algorithm is ever compromised, the remaining two maintain verification. Every hash is signed with the device's TPM-rooted identity certificate, then embedded alongside a C2PA 2.2 provenance manifest recording device, operator, location, timestamp, and capture settings. From this moment, any alteration — a single pixel, a single frame, a single byte — is mathematically detectable.

No single party should control the truth about evidence. Traditional chain of custody relies on paper logs, database entries, and institutional trust — systems where a sufficiently motivated insider can alter records without detection. Blockchain eliminates this vulnerability by distributing custody records across a permissioned peer network where no single party can unilaterally modify history. Every custody event — acquisition, transfer, access, copy, analysis, export — is recorded as a blockchain transaction signed by the actor's digital certificate and anchored with the evidence's current hash. Smart contracts enforce custody rules: a transfer requires both the releasing and receiving party's digital signatures; access outside authorized hours triggers an immediate alert; any hash mismatch between the stored and computed values raises a tamper flag that propagates to all peers in real-time. Permissioned blockchains like Hyperledger Fabric are especially well-suited for forensic applications because they offer the identity management, fine-grained access control, and high throughput that public chains cannot provide.

Courts are encountering AI-generated exhibits with increasing frequency, and judges are growing skeptical of digital evidence without clear provenance. The EU's AI Act mandates disclosure and watermarking of synthetic media. The U.S. "Take It Down Act" criminalizes certain deepfakes. But regulation alone cannot solve the detection problem — that requires technology. Vault's deepfake detection engine operates on four layers simultaneously: visual analysis (detecting GAN fingerprints, diffusion model artifacts, face swap boundaries, temporal inconsistencies in video, and micro-expression anomalies), acoustic analysis (identifying voice synthesis spectral signatures, prosody inconsistencies, and breathing pattern artifacts), metadata analysis (EXIF/XMP integrity verification, compression artifact forensics, and device-specific sensor noise pattern matching), and provenance analysis (C2PA manifest chain validation from capture device through every processing step). All detection results are logged to the blockchain alongside the evidence itself, creating a permanent, auditable record of what was analyzed, when, by which version of the detection model, and what confidence level was assigned.

Three conditions must be met simultaneously for digital evidence admissibility: authenticity (the file is linked to a verified source and has not been fabricated), integrity (a cryptographic hash confirms no modification since capture), and a documented chain of custody that accounts for every access and transfer. Engine 04 automates the assembly of court-ready authentication packages that satisfy all three conditions with mathematical precision. Each package includes the original evidence file with embedded C2PA manifest, the hash verification report (showing triple-hash values at capture and current, confirming identity), the complete custody chronology extracted from the blockchain ledger (every transfer, access, and verification event with timestamps and signer identities), the deepfake analysis results from Engine 03 (with model version, confidence score, and methodology description), the device identity chain from TPM root to capture device, and a qualified certifying declaration suitable for submission under FRE 902(13)-(14). Platforms producing evidentiary certificates that reference blockchain elements are becoming increasingly preferred tools in judicial contexts.