Preserving Deepfake Evidence: A Practical Guide for Victims & Journalists

Introduction: Why careful preservation matters

Deepfakes and AI‑imitation media can spread quickly and be used to defame, extort, scam, or influence. For victims and journalists, early, disciplined evidence preservation is the difference between a successful takedown, a credible investigative report, or admissible evidence in court — and material that platforms, lawyers, or investigators will regard as unreliable. Practical documentation (screenshots with context, original files, metadata, and a clear chain‑of‑custody) is essential for verification and for any legal or platform escalation.

This guide gives a concise, operational checklist and the core technical steps to preserve audio, video, and metadata, and to maintain a defensible chain‑of‑custody suitable for journalists, victims, or first responders.

Immediate actions (first hour) — a practical checklist

When you first encounter suspected deepfake media, act quickly but deliberately. Follow these prioritized steps:

1. Do not alter the original file or device. If the file is on your phone, leave it there. If the content is a platform post, do not edit or crop it — take evidence in a way that preserves original context. If you must view the file, work on a copy only.
2. Take context screenshots. Capture screenshots that include the account name, profile URL, post timestamp (or message timestamp), visible comments, and any accompanying text or links. For social posts, capture the page URL in your screenshot or use an archiving service.
3. Download and save the highest‑quality original available. Use the platform’s native download/export feature if present, or request the original from the sender. If you have an original camera file (e.g., .MOV, .MP4, .AUDIO/WAV), preserve that file — not a compressed re‑upload.
4. Request preservation/legal holds from platforms. Many platforms offer record preservation or formal requests for law enforcement/journalists; request a preservation or evidence hold immediately to prevent automatic deletion. Keep copies of request receipts or ticket numbers.
5. Document chain‑of‑possession notes. Start a simple log: where you found the file, date/time, who provided it, and what actions you took. Keep this log separate from the evidence copies. See the sample chain‑of‑custody table below.
6. Preserve corroborating signals. Save related messages, phone call logs, payment records, emails, or account screenshots that show intent, timing, or distribution paths — these support context and attribution.

These immediate steps protect authenticity and context. If you are a journalist, also consider publication‑safety steps (consult editorial/legal teams before publishing any identifying content or admitting private material to the public).

Technical preservation: copies, metadata extraction, hashing and verification

Workflows below assume you are preserving content for verification and possible legal use. They progress from low‑effort (copy & screenshot) to forensic (disk images, notarized acquisition).

Create defensible copies

• Make an initial binary copy (byte‑for‑byte) of any file you receive. For files on phones, use a direct file transfer (USB, AirDrop to a controlled machine, or secure file export). Avoid re‑encoding or screen‑recording as the primary copy, unless that is the only option.
• Label and store the original copy ("master") in a read‑only or write‑protected folder. Work only with separate working copies.

Compute and record cryptographic hashes

Generate and record a SHA‑256 (or other NIST‑recommended) hash for each master and working copy. Hashes prove byte identity: any change to the file will alter the hash. Store the hash values in your chain‑of‑custody log and in at least one separate, secure location. SHA‑256 is widely recommended for forensic fixity checks.

Extract metadata and technical signals

Metadata and embedded technical traces are key to assessing provenance and tampering. Use open tools:

• ExifTool (command line) reads extensive metadata from images, audio, video, and many file types (timestamps, device make/model, encoder details). It is the de‑facto metadata extraction tool for journalists and investigators.
• FFmpeg can inspect container details and repackage/transcode for analysis (do not transcode original master when preserving). FFprobe (part of FFmpeg) reveals codec, duration, bitrates and stream maps, which are useful when comparing originals to alleged sources.
• Forensic/verification tools such as InVID (video verification toolkit) and Amped Authenticate provide near‑duplicate search, frame analysis, compression artifact detection and specialized deepfake filters; these are useful when you need a professional verification layer. Use them as guidance — detection tools are imperfect and should be combined with metadata and contextual signals.

Record a verification snapshot

When you extract metadata or run verification tools, export and save the tool outputs (text reports, JSON, screenshots) with timestamps and include their hashes in the custody log. This documents what steps were run, when, and by whom. Keep tool versions and command lines recorded for reproducibility.

Chain‑of‑Custody: sample form and practical tips

A simple, well‑kept chain‑of‑custody (CoC) log preserves the chronological record of every person who handled the evidence and every action taken. Keep the log with the evidence, and store an offsite copy. Below is a compact CoC table you can adapt; keep one line per transfer or action.

Practical tips:

• Minimize transfers; each additional transfer increases risk and must be logged.
• Record tool names, versions, and exact commands used (for example: exiftool 12.99 — "exiftool -all -G1 file.jpg"), because reproducibility matters in legal and editorial contexts.
• Use tamper‑evident storage where available (write blockers for disks, sealed media cases, or secured cloud buckets with access logs).
• If evidence may be needed for prosecution, contact law enforcement or a digital forensics lab and hand over materials with the CoC you started; do not attempt invasive forensic examination if you are not trained — you can inadvertently alter data.

Where to escalate and report

After preservation, escalate as appropriate: platform takedown requests, newsroom legal teams, civil counsel, or law enforcement. Provide the preserved master files, hash values, metadata reports, and the CoC log. Agencies and platforms often require formal preservation requests to keep records beyond ordinary retention windows.

Limitations & cautions: Hashes show that a file is unchanged, not that it is genuine. Metadata can be forged or stripped; detection tools can give false positives/negatives. Combine technical signals with reporting, corroboration, and expert analysis before drawing final conclusions.