Create and Verify an Evidence Package
Package a Capture project's original evidence, records, documents, and signatures, then verify every file with SHA-256.
Package a Capture project's original evidence, records, documents, and signatures, then verify every file with SHA-256.
Only a company Owner or Admin can create or download a project evidence package. Treat the ZIP as sensitive: it contains original stored evidence and is not the same as a customer-facing, redacted share link.
A package may move through Queued, Running, Succeeded, Failed, or Expired. If generation fails, use the retry action shown with that request. Requests and downloads are recorded in the company audit log.
The package is organized so an auditor can connect stored bytes to JobsiteOn records:
originals/ contains byte-identical stored Capture media originals. Voice-note originals
are under originals/voice-notes/.documents/reports/ and documents/proposals/ contain issued or frozen document files
when those stored artifacts exist.documents/signatures/ contains stored signature images when present.capture-metadata.json, activity-log.json, document-records.json, and
signature-records.json contain the corresponding project records.manifest.json lists every packaged entry, its byte count, SHA-256 digest, category, and
source record.manifest.sha256 contains the independent digest for manifest.json.README.txt repeats the verification steps inside the package.Thumbnails, display renditions, stamped or watermarked copies, HLS output, and redacted derivatives are excluded. The package uses stored originals so a verifier can test the evidence itself, not a presentation copy.
Extract the ZIP into an empty directory. On Linux, run:
sha256sum -c manifest.sha256
On macOS, run:
expected=$(cut -d ' ' -f 1 manifest.sha256)
test "$(shasum -a 256 manifest.json | cut -d ' ' -f 1)" = "$expected"
A successful command confirms that manifest.json has not changed. The manifest does not
list itself or manifest.sha256, because a file cannot contain its own final digest.
For every object in the manifest's entries array:
path.sha256.bytes.Every digest and byte count must match. A mismatch means the extracted package is incomplete or changed; create a fresh package and preserve the failed verification result for your records.
The package row shows when the stored artifact expires; the standard retention window is seven days. Each Download action creates a new private link that expires after five minutes. If the link expires while you are saving the file, return to the same succeeded request and select Download again.
Did this answer your question?