"Download all" didn't mean all: what an evidence platform gives the defense, and what it keeps
The situation
A prosecutor uploaded digital discovery — police videos, photographs, audio, reports, mobile extractions, surveillance clips — to a commercial evidence-sharing platform and sent defense counsel a secure link. Counsel downloaded everything visible. What the platform also held, and did not include in that download, was the evidentiary record around the files.
What the other side said the evidence showed
That discovery had been produced: the defense had received the files, could play them, and had everything the State had uploaded.
The platform's interface is not the evidence. It's a viewer sitting on top of the evidence.
Evidence-sharing platforms maintain excellent records — original upload timestamps, original filenames, file hashes, user access records, replacement history, redaction history, export history, and version information. They also, by design, hand out simplified derivative files so that anything will play in any browser. Both things are true simultaneously, and the second one is what lands in the defense download folder.
The question is therefore not whether counsel received playable files. It is whether counsel received the information needed to evaluate authenticity, completeness, changes, provenance, version history, and chain of custody. A platform-generated preview named Officer2.mp4 answers none of those questions about a body-camera file uploaded as BODYCAM_Officer2_2026-04-18.evf.
The hash consequence follows directly. The platform records a hash at upload; the defense download has a different one because it is a different object. That mismatch is not evidence of tampering — it is evidence that the defense is not looking at what law enforcement uploaded, which is a discovery issue rather than a scandal, and one that only surfaces if somebody asks.
What the examination involved
Compared what was uploaded against what was downloaded
Obtained the platform records and lined them up: the police-uploaded master in its native proprietary format, the platform-generated preview, and the file the defense actually received. The defense file was the preview.
Catalogued what the preview had lost
Original camera identifier, original creation metadata, proprietary event markers, GPS track, device serial number, original hash, bookmark information, and officer annotations — none of which survive preview generation.
Requested and read the platform audit logs
Who uploaded each file and when, who viewed it, who replaced it, who generated a preview, who downloaded it, and when the link expired.
Identified an undisclosed replacement
The logs showed the prosecutor's office had replaced one file after the original upload because the first version contained unredacted personal information. The defense received only the later version; the replacement history was not part of the ordinary download.
Reconciled hashes across versions
The upload hash and the downloaded file's hash differed, consistent with the download being a derivative preview rather than the master.
What the examination found
- The defense had received platform-generated previews, not the files law enforcement uploaded
- Original hashes, camera identifiers, GPS tracks, device serials, event markers, and annotations were absent from the production
- One file had been replaced after upload, and the replacement history was not disclosed in the normal download
- The audit log established upload, access, preview generation, replacement, and download events that the media files alone could not
- Nothing in the production would have revealed any of this to counsel who simply clicked download all
Outcome
The gap was procedural rather than adversarial — the platform behaved as designed and the production reflected default behavior. That does not make it adequate. Resolving it required master-file access, hash manifests, audit history, and native metadata, none of which had been requested because nobody knew they existed.
Takeaways for counsel
- Ask explicitly whether the platform distributes original files, previews, redacted derivatives, or recompressed copies. The answer is often "previews" and is almost never volunteered.
- Request native files, original filenames, hash manifests, upload logs, replacement history, redaction records, platform metadata, and the complete folder structure — by name, in the discovery request.
- A hash mismatch between your copy and the evidence-system master usually means you have a derivative, not that someone tampered with anything. Establish which before arguing either.
- Replacement and redaction histories are where undisclosed changes live. They are recorded, and they are not in the default download.
- "Download all" is a user-interface label, not a certification of completeness.
Related questions
Compare filenames and formats against what the platform records as uploaded, and compare hashes. A proprietary extension in the upload record and a generic .mp4 in your folder is the clearest signal. If the production carries no hash manifest at all, that itself is worth raising — there is no way to verify what you have against what exists.
Have a case that turns on digital evidence?
Tell us the case, the device, and your deadline. The scoping call is free, and we'll tell you honestly whether an examination is worth it.
Appointed counsel: see our Colorado public defender program.
More case studies
Deleted files in an employee-theft prosecution: what the artifacts proved, and what they couldn't
Deleted texts and edited screenshots: the one-hour timestamp error that moved a message before the order took effect
The video played at trial wasn't the video in discovery: PowerPoint, transcoding, and normalized audio
This case study is illustrative. It is written to show how digital evidence is examined, challenged, and presented in court; it is not an account of any client matter, and any resemblance to a specific case is unintended. The techniques and failure modes described are real. Nothing on this page is legal advice, and no result is a prediction or guarantee of the outcome of any other matter.