Help Center

Uploading Evidence

Evidence is the foundation of every case in Timestamped. You can upload videos, photos, audio recordings, and documents directly to a case. Each piece of evidence is automatically processed to extract metadata, verify integrity, and (for videos with audio) generate searchable transcripts.

How to Upload Evidence

1. Open the case you want to add evidence to
2. Click the Upload button in the evidence section
3. Select one or more files from your device:
   • Video: MP4, MOV, AVI, MKV, WebM
   • Photo: JPEG, PNG, HEIC, WebP, TIFF
   • Audio: MP3, WAV, M4A, AAC, OGG
   • Documents: PDF, DOCX, XLSX, CSV, TXT
4. Files begin uploading immediately using resumable uploads, so large files can survive network interruptions
5. Once uploaded, background processing starts automatically (thumbnail generation, metadata extraction, hash verification, and transcription if applicable)

Evidence Types

Evidence Integrity

Timestamped automatically protects the integrity of every piece of evidence you upload. This is critical for court admissibility and professional credibility.

• SHA-256 Hashing: A cryptographic hash is computed on your device during upload and verified again on the server. This proves the file has not been altered since you captured it.
• EXIF Preservation: Original metadata from the file (capture time, GPS coordinates, device information) is extracted and stored separately so it can never be lost, even if the file format changes.
• Immutability: Once uploaded, the original evidence file cannot be modified. You can add notes, tags, and display metadata, but the underlying file and its captured metadata remain untouched.
• Audit Trail: Every action taken on evidence (upload, view, download, inclusion in a report) is logged with a timestamp and user identifier.

Transcription

When you upload a video or audio file that contains speech, Timestamped automatically extracts the audio and sends it to AssemblyAI for transcription. The resulting transcript includes:

• Word-level timestamps that sync with video playback
• Speaker labels when multiple speakers are detected
• Keyword highlighting based on your organization's configured keywords (e.g., "subject", "vehicle", "exchange")
• Suggested moments generated automatically when keywords are detected in the transcript

Transcription time is metered based on your subscription plan. Organization-level keyword configuration is managed from AI Features. Usage is consumed in this priority order: subscription allocation first, then any referral bonuses, then prepaid balances, and finally overage (if your plan allows it). You can monitor your usage in the billing section.

Evidence Processing

After upload, each piece of evidence moves through a background processing pipeline. The current stage is shown as a processing status badge on the evidence thumbnail.

Processing Statuses

Security Validation

Before processing begins, Timestamped performs a security check on every uploaded file. The first 4 KB of the file is inspected to verify that its "magic bytes" (file signature) match the claimed file type. This prevents malicious files (for example, an executable renamed to .jpg) from being stored and served to other users.

If the magic byte check fails, the evidence is flagged as security-rejected and will not be processed further. The file remains in storage for admin review but is not visible in the case evidence gallery.

Hash Mismatch Handling

During processing, the server computes its own SHA-256 hash and compares it against the hash your browser computed during upload. If the two hashes do not match, the evidence is flagged with a hash mismatch warning. This does not prevent you from using the evidence, but it signals that the file may have been altered in transit. The server-computed hash is always treated as authoritative.

Capturing Moments

Moments are starred timestamps within a video that mark significant events. They act as bookmarks into your footage, making it easy to navigate directly to important events without scrubbing through hours of video.

How to Add a Moment

1. Open a video evidence item from the case evidence gallery
2. Play the video or scrub to the point of interest
3. Click the Star button or press M on your keyboard at the desired timestamp
4. Add a descriptive note (e.g., "Subject exits vehicle at northeast corner of parking lot")
5. A keyframe (screenshot) is automatically generated at that timestamp

Moments appear on the video timeline, in the case event feed, and can be included in reports as exhibits with their keyframe images.

Evidence Organization

Keep your evidence organized within a case using these features:

• Folders: Create folders within a case to group related evidence together. For example, you might have separate folders for each day of surveillance, by location, or by evidence type. A single evidence item can belong to multiple folders at once, so you can organize the same photo by date and by subject without duplicating it. Drag and drop evidence between folders, or use bulk move to reorganize multiple items at once.
• Star: Star important evidence items to surface them quickly. Starred evidence appears first in filtered views.
• Notes: Add descriptive notes to any evidence item to provide context for reviewers.
• Tags: Apply custom tags to categorize evidence (e.g., "surveillance", "interview", "document").
• Cover Photo: Set any photo as the case cover photo, or choose a specific timestamp from a video. The cover photo appears as the case thumbnail in your case list and dashboard for quick visual identification.

Bulk Operations

When working with large cases, you can select multiple evidence items and apply actions in bulk:

• Bulk rename: Rename multiple evidence items at once using a naming pattern. Useful for standardizing file names after a large upload.
• Bulk move to folder: Move selected evidence items into a folder in a single action.

Case Export

You can export an entire case as a ZIP file containing all evidence files and metadata. This is useful for creating offline backups, delivering a complete evidence package to a client, or archiving a closed case. To export, open the case and select Export Case from the actions menu. The export is generated in the background, and you will be notified when it is ready for download.

Understanding Evidence Metadata

When you capture a photo or record a video, your device embeds invisible data called EXIF (Exchangeable Image File Format) metadata into the file. This metadata is critical for investigations because it provides verifiable, device-generated proof of when and where evidence was captured.

What is EXIF Data?

How Timestamped Uses Metadata

Timestamped extracts and stores metadata from each evidence file automatically. The following table shows which fields are extracted and how they are used.

Captured vs Uploaded Times

Timestamped distinguishes between two important timestamps for every piece of evidence:

• Captured time (metadata.capturedAt): When the file was originally created on the recording device. This comes from the file's EXIF data and is immutable.
• Uploaded time (createdAt): When the file was uploaded to Timestamped. This is set by the server and is also immutable.

These two timestamps often differ. An investigator might capture footage in the field at 2:00 PM but not upload it until returning to the office at 5:00 PM. Both times are preserved and visible in the evidence detail view.

GPS and Location Data

When location services are enabled on the capture device, GPS coordinates are embedded in the file's EXIF data. Timestamped extracts these coordinates and displays them alongside the evidence.

Display vs Original Metadata

Timestamped uses a two-layer metadata system to keep original data intact while giving you control over presentation:

• Original metadata (metadata.*): Extracted from the file's EXIF data. Immutable and always preserved for integrity purposes.
• Display location (displayLocation): A user-editable field that defaults to the EXIF GPS coordinates. You can override this with a human-readable address (e.g., "Northeast corner of Main St and 5th Ave") without altering the original GPS data.
• Display time (displayTime): A user-editable field that defaults to the EXIF capture time. Useful when the device clock was incorrect and you need to note the actual time of an event.

Reports and exports always have access to both the original metadata and the display values, so you can present readable information to clients while maintaining the verifiable original data for legal proceedings.

What If Metadata Is Missing?

Not all files contain EXIF metadata. Common reasons include:

• Location services were disabled on the capture device at the time of recording
• The file was exported from editing software that strips metadata
• The file was sent through a messaging app (such as WhatsApp or iMessage) that removes EXIF data for privacy
• The file format does not support EXIF (e.g., some older formats or screen recordings)

When metadata is missing, Timestamped still records the upload time and uploader information. You can manually set the display location and display time fields to add context that the file itself does not contain.

Metadata in Reports

When you include evidence in a report, the metadata is presented in a structured format:

• Evidence exhibit blocks show the display location, display time, and file type
• The chain-of-custody appendix includes the SHA-256 hash, original capture time, upload time, and device information
• If display values differ from original metadata, both are shown in the appendix for transparency

Evidence Visibility and Ownership

Evidence Belongs to the Case

Evidence in Timestamped is always attached to a specific case. It does not float freely in your account or organization. This means:

• Every evidence file is associated with exactly one case
• Access to evidence is governed by the case's access controls (ACLs), not by who uploaded the file
• If you have access to a case, you can see all evidence within it (subject to your permission level)
• Moving evidence between cases is not supported to preserve chain of custody. Use case sharing (transfers) when you need to share evidence with another organization.

Who Can Edit Evidence

What's Tracked

Every piece of evidence maintains a record of the following, regardless of who later views or edits its display fields:

• Uploaded by: The user who originally uploaded the file
• Uploaded at: The server timestamp when the upload completed
• File hash: The SHA-256 hash computed during upload for integrity verification
• Original metadata: All EXIF data extracted from the file at the time of upload

Evidence Files Are Immutable

Once a file is uploaded, the original file cannot be replaced, re-encoded, or modified. This is by design. Immutability ensures that the SHA-256 hash remains valid and that the chain of custody is unbroken.

You can update display fields (notes, tags, display location, display time) at any time. These changes are tracked in the activity log but do not affect the underlying file or its original metadata.

Deleting Evidence

When you delete evidence, it enters a soft-delete state with a grace period before permanent removal. During the grace period, the evidence is hidden from normal views but can be restored if needed. After the grace period expires, the file and all associated data (thumbnail, transcript, moments) are permanently deleted.

• Only users with editor-level access (or higher) on the case can delete evidence
• Deletion is logged in the case activity feed with the user and timestamp
• If the evidence was included in a report, the report will show a placeholder indicating the evidence was removed
• Legal hold: Cases under legal hold cannot have evidence deleted. This prevents accidental or intentional spoliation of evidence that may be required for legal proceedings. See the Cases page for details on legal holds.

Sharing Evidence Outside the Team

There are several ways to share evidence with people outside your organization:

• Reports with shared links: Generate a report and share it via a secure link. Recipients see the report (including any embedded evidence) without needing a Timestamped account.
• Case transfers: Use the escrow-based transfer system to share entire cases (with selected evidence) with a partner organization. Both parties retain their own copy.
• External user access: Invite an external user (such as an attorney or insurance adjuster) to the case with viewer-level access. They can log in and view evidence directly.
• PDF/DOCX export: Export a report as a PDF or DOCX file and share it through your own channels (email, file sharing, etc.).

Storage and Lifecycle

Evidence files are stored in Google Cloud Storage with automatic lifecycle management that reduces costs as files age.

Storage Tiers

These transitions happen automatically. You do not need to take any action. Evidence in older tiers may take a moment longer to load the first time it is accessed, but all features (viewing, downloading, including in reports) work the same regardless of tier.

Signed URL Expiration

Evidence files are never served directly. Instead, Timestamped generates short-lived signed URLs that expire after 1 hour. Each time you view evidence, a fresh URL is generated automatically. This means that links to evidence files cannot be shared externally by copying the URL from your browser: the link will stop working after the expiration window.