Tamper-evident, not tamper-proof: what that actually means
- Tamper-evident means any change made to a record after it is saved leaves a visible trace. It does not claim change is impossible. It claims change is detectable.
- Tamper-proof is a claim nobody can honestly make about a digital record. Files can be edited, replaced, or deleted, and no app can promise otherwise.
- A tamper-evident record rests on two ordinary mechanisms: a cryptographic fingerprint of the entry taken the moment it is saved, and an independent timestamp from an outside authority proving when that fingerprint existed.
- A note in your phone is not tamper-evident. It can be edited later with nothing to show for it, and its only proof of timing is a clock you control.
- Tamper-evident does not make a record true, and it does not make it automatically admissible. It answers one specific challenge: “you could have written that last week.”
What does tamper-evident mean?
A record is tamper-evident when any change made to it after it was saved leaves a visible trace. The record is not locked away. It is witnessed. If an entry is edited, backdated, reordered, or swapped for a different one, the change shows.
The idea long predates software. A foil seal on a bottle, a security strip across a package, a numbered tag on a shipping container — none of those stop a determined person from getting inside. What they do is make it obvious to the next person who looks. A tamper-evident digital record works on the same principle, with arithmetic doing the job the foil does.
How is tamper-evident different from tamper-proof?
Tamper-proof claims a record cannot be altered at all. For anything stored on a phone or a computer, that claim does not survive contact with reality. A file can be edited. A file can be deleted. An entire device can be wiped or lost. Any product that describes its records as tamper-proof is either being loose with the word or asking you to trust a promise it has no way to keep.
Tamper-evident makes the narrower claim — and it is the one that can actually be demonstrated.
| “Tamper-proof” | Tamper-evident | |
|---|---|---|
| What it claims | The record can never be changed | Any change to the record is detectable |
| Can it be demonstrated? | No — it is an assertion | Yes — anyone can re-run the check |
| If a file is edited | The claim quietly fails | The seal no longer matches, visibly |
| Proof of when it was written | Usually the device’s own clock | An independent third-party timestamp |
| Honest to say about a phone app | No | Yes |
The distinction matters most in the one room where it gets tested. “This can never be changed” is an assertion, and an assertion invites cross-examination. “Here is the fingerprint taken when this entry was saved, here is the third-party timestamp on it, and here is the check anyone can run to confirm the entry still matches” is a demonstration. A demonstration is considerably harder to argue with, and it does not ask anyone to take your word.
How does a record actually become tamper-evident?
Two mechanisms, both ordinary, both decades old.
A cryptographic hash. When an entry is saved, the software runs its contents through a hash function, which produces a short fingerprint of fixed length. Change one character of the entry — a single letter, one digit in a time — and the fingerprint changes completely and unpredictably. Comparing an entry against its stored fingerprint later is what makes an alteration visible rather than silent.
An independent timestamp. That fingerprint is then sent to a trusted timestamping authority, an outside service that signs it with the current time and returns a token. The standard for this is RFC 3161, an internet standard used to timestamp software releases, financial records, and legal documents. The part that matters for a personal record: only the fingerprint leaves the device. The timestamping authority never receives, stores, or reads the entry itself. It attests to one narrow fact — that this exact fingerprint existed at this exact moment — and that attestation does not depend on your phone’s clock, which you can change.
Entries can also be chained: each new entry’s fingerprint incorporates the one before it, so the entries are linked in order. Removing an entry from the middle, or quietly reordering two of them, breaks the chain in a way that is visible on inspection. That is the whole mechanism. There is nothing exotic in it, which is exactly why it is credible.
Any change to a record after it is saved leaves a visible trace. It does not claim a record can never be altered. It claims alteration is detectable. More terms in the glossary →
Why is a note in your phone not tamper-evident?
Most parents start with what is already on the phone, and there is nothing wrong with starting there. It is worth being clear-eyed about what those tools do and do not prove.
- A notes app. Entries can be edited at any time, and the edit generally leaves no visible record. The date attached to a note is metadata your device controls.
- A photo library. Photos carry useful metadata, but that metadata can be edited, stripped by sharing or exporting, or simply lost when files move between devices.
- A spreadsheet or document. Every cell is editable forever, and the file’s modified date moves every time you touch it — which means an honest correction and a rewrite look identical.
- Emailing yourself. Genuinely better than the others, because a mail server keeps a copy with its own timestamp, outside your control. It is also unstructured, hard to search across months, and awkward to hand to an attorney as an organized record.
None of these are tamper-evident, and none of them are worthless. The gap is narrow and specific: nothing about them shows a later reader whether an entry has been changed since the day it was written.
Why does this matter in a custody case?
Because the most predictable challenge to a record you kept yourself is not about what it says. It is about when you wrote it. A record produced months into a dispute invites one question before any other: was this written as it happened, or assembled later to make a point?
A tamper-evident record with independent timestamps answers that question with something other than your own testimony. The Federal Rules of Evidence anticipate this directly. Rule 901(b)(9) allows evidence to be authenticated by describing a process or system and showing that it produces an accurate result. Rules 902(13) and 902(14), added to the federal rules in 2017, go further: certified records generated by an electronic process, and certified copies of data verified by a process of digital identification — hash comparison, in plain terms — can be self-authenticating, without live testimony from a technical witness.
State family courts have their own rules of evidence, and they vary. Many states have adopted provisions that closely parallel the federal ones. The general principle holds broadly: a process that can be described and independently verified carries more weight than one that has to be taken on faith.
What tamper-evident does not do
Worth saying plainly, because overselling this would defeat the point of using the honest word in the first place.
- It does not make an entry true. A tamper-evident record of an inaccurate statement is a sealed inaccurate statement. The seal proves the entry has not changed since you wrote it, not that you wrote it correctly.
- It does not make a record admissible. Authentication is one hurdle among several. Relevance, hearsay rules, and your state’s own requirements all still apply, and a judge decides.
- It does not stop you from deleting your own record. Nothing on your own device can.
- It does not replace writing things down close to when they happen. Timing and consistency do most of the work in how a record is received. Tamper-evident sealing protects that work; it is not a substitute for it.
Documented seals each entry and timestamps it independently the moment you save it, so the record’s timing does not rest on your own device’s clock. It stays a private record on your device — nothing is sent to anyone else, and the timestamping authority only ever sees a fingerprint, never what you wrote.
Frequently asked questions
What does tamper-evident mean?
It means that any change made to a record after it was saved leaves a visible trace. A tamper-evident record does not promise it cannot be altered — it promises alteration would be detectable by anyone who checks.
Is tamper-evident the same as tamper-proof?
No. Tamper-proof claims a record can never be changed, which no app can honestly promise about a file on your phone. Tamper-evident claims any change would be visible, which can actually be demonstrated.
Can a note in my phone be used as evidence in a custody case?
It can be offered, and it is better than nothing. Its weakness is that it can be edited without a trace, and the only proof of when you wrote it is a clock you control — which is exactly what gets challenged.
What is RFC 3161 timestamping?
RFC 3161 is the internet standard for trusted timestamps. A timestamping authority signs a fingerprint of your data with the current time and returns a token proving that fingerprint existed at that moment. The underlying data itself never leaves your device.
Does a tamper-evident record mean my entries are stored on someone else’s server?
Not necessarily. In a design like Documented’s, only the cryptographic fingerprint is sent for timestamping. The fingerprint cannot be reversed back into the entry, so the content of what you wrote stays with you.
References
This article explains general, well-established evidence-law and cryptography concepts — it is not legal advice and does not reflect any specific state’s rules, which vary. Confirm specifics with an attorney or your court’s self-help center.
- RFC 3161 — Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP)
- Federal Rules of Evidence, Rule 901 — Authenticating or Identifying Evidence (see (b)(9))
- Federal Rules of Evidence, Rule 902 — Evidence That Is Self-Authenticating (see (13) and (14))
Related articles
Documented is a private, tamper-evident record of how you show up for your kids. This article is general information, not legal advice, and Documented is not a law firm.