I add a SHA-256 hash and a quick provenance note to every public record PDF the minute I pull it, so the chain stays clean and easy to show. On Windows I run Get-FileHash in PowerShell. on Mac I use shasum -a 256, then paste the checksum and the source URL, record ID, and timestamp into a plain CSV that lives in the case folder. I also save the receipt page from the clerk portal or the search results as a PDF and rename the file with the jurisdiction and docket reference so anyone can retrace the path later without guessing. If a clerk republishes a corrected document, I never overwrite. I save the new file with a version suffix, log the new hash, and note who requested the update and when I verified it. I do it right after the download while it’s still in the Downloads folder, then move it into the matter structure so the file path in the log matches where it lives. This takes under a minute per file and has saved me when authenticity gets questioned.
Reminds me of package manager lockfiles: pin the exact content. I add SHA-256, byte size, Last-Modified, page count, and original filename to a sidecar CSV, and tuck the hash into PDF metadata. I also save raw HTTP headers to spot quiet reuploads, and GPG-sign the CSV. Do you keep headers?
I do the same but add a few guardrails. Hash the raw bytes immediately and never re-save the PDF. do OCR or redaction only on a copy. Keep the CSV and record the tool version and your download method. Save the full HTTP response headers (curl -D headers.txt) and a screenshot or PDF of the landing page.
I also capture the full HTTP exchange (headers + body) to a WARC alongside the raw PDF and hash the body bytes. Reason: headers change and some endpoints re-encode or watermark on the fly. I note redirects. Content-Disposition filename. ETag type, and server IP.
Grabbed a zoning memo yesterday: shasum -a 256 the raw download, pasted hash. URL, timestamp, and byte size into a sidecar .txt, then set the original file read-only. OCR’d a copy, kept both hashes in a CSV. Takeaway: hash the untouched bytes and log enough context to replay provenance later, including page count and Last-Modified when available.