What a Lumethic Record Contains, and How to Check It

The Timestamp Authority

The anchor is an RFC 3161 timestamp token. Lumethic signs the receipt, computes a hash of that signed receipt, and sends only the hash to the authority, which is currently DigiCert's public timestamp service. The authority signs the hash together with the time from its own audited clock and returns the token. The authority never sees the files or the manifest, and Lumethic cannot set the time.

"Independent" therefore means: a separate company, with its own signing key under its own certificate hierarchy and its own published timestamp practice statement, in a protocol where Lumethic supplies a hash and nothing else. The authority does not vouch for the files and has no relationship with the parties. It is a public service that Lumethic chose to trust and that anyone can verify against.

The token is not an eIDAS qualified electronic time stamp. In the European Union, Article 41(1) of the eIDAS Regulation provides that an electronic time stamp may not be denied legal effect or admissibility as evidence solely because it is electronic or is not qualified; the presumption of accuracy of date and time and of integrity of the bound data in Article 41(2) is reserved to qualified time stamps, which these are not. In Germany a non-qualified time stamp is weighed under the free evaluation of evidence in § 286 ZPO, and § 371a ZPO, which concerns qualified electronic signatures, is not engaged. Elsewhere, local counsel states the rule.

Lumethic's own signature on the receipt uses an S/MIME certificate issued to Lumethic. It identifies the issuer, and the timestamp covers it regardless of the certificate type.

What the Record Does Not Cover

The record starts at the first backup. Nothing in it covers the memory card between the shutter and the moment the hash list was written, and nothing in it states when the photographs were taken; the camera clock is the photographer's setting, and the receipt dates the offload, not the exposure. Backing up on the shoot day narrows that gap to hours. Backing up a week later leaves a week the record does not cover.

The record does not state that the scene was real, that the photograph is true, or that a file is admissible anywhere. It does not lock a card, and it cannot verify a print. A verification report is not an opinion about authenticity. It is a set of comparisons with their results.

The Verification Checks and Their Validation Status

A verification compares a delivered JPEG with the RAW file it was paired with. The checks are: sensor-noise and structure analysis of the RAW, metadata consistency between RAW and JPEG, structural similarity and a perceptual hash between the JPEG and a reference rendered from the RAW, a tonal comparison of histograms, recapture detection (a photograph of a screen or print), and face detection used only to locate regions for comparison. Each check has a threshold at the current methodology version, and the report lists the scores against those thresholds and marks any check that did not run.

"Verified RAW" means a RAW file whose sensor-noise statistics, bit-depth structure and metadata passed these consistency checks. It does not mean the file is proven to be the first recording of the scene. Verification assumes that fabricating a sensor-consistent RAW file is beyond the adversary as of the current methodology version; that assumption is stated here with a date and revisited quarterly.

Validation status as of this page's date: the checks were calibrated on 397 genuine images of one class, and recapture detection was evaluated on twelve files. Error rates for manipulated RAW and JPEG pairs have not yet been published. Until then, read a report as a consistency screen with stated thresholds. Any contested question of authenticity belongs to a qualified examiner.

Which Edits Pass

Cropping, exposure and white balance changes, lens and perspective correction, dust removal and annotation are expected to pass. Compositing, object removal and generative fill are expected to fail. The exact behaviour depends on the methodology version and is published with it; the report records which checks ran and which were skipped, so a borderline result can be read in context.

How to Reproduce the Checks

Every receipt can be checked on the public receipt page without an account. For an independent check with standard tools:

1. Recompute the hash of any file on the card with the algorithm named in the manifest (c4id for C4, shasum -a 256 or hashdeep -c sha256 for SHA-256) and compare it with the manifest entry.
2. Confirm the manifest bytes match the hash recorded in the receipt.
3. Verify Lumethic's signature over the receipt core and the timestamp token over the signed core, using the certificates embedded in the receipt, with openssl ts -verify or an equivalent.

The receipt embeds the certificates it was signed with. Certificate chain-path building and revocation status are not checked by the hosted page and are listed there under "Not checked"; an examiner who wants them performs them against the authority's published chain.

How Long a Receipt Can Be Checked

A receipt verifies with standard tools for as long as the timestamp authority's certificate can be validated. Timestamp authorities rotate their certificates, and the receipt does not currently embed a revocation snapshot or carry a renewed timestamp, so the practical horizon is the validity of the authority's certificate and of the signature algorithms. Download every receipt and report on delivery and keep them together with the manifest and the originals. Long-term re-anchoring for multi-year matters, which would renew the timestamp before the authority's certificate expires, is in development and is not a feature of any plan.

Receipts are never revoked. Deleting a record at Lumethic does not invalidate a receipt that has already been downloaded, because the receipt verifies against its own contents.

Contested Findings and Who to Ask

If a verification result is disputed, start from the scores and thresholds in the report. A contested authenticity opinion is the work of a qualified forensic image examiner, who can treat the record as chain-of-custody substrate and perform their own examination on the originals. Lumethic will answer technical questions about the checks by email, and states what it can and cannot say about a specific record; it does not offer opinions on the scene.

Reliance Statement

Every receipt and report should be read with this statement, which is what Lumethic itself says about them:

This document records the checks performed and their results. It does not state that the scene depicted is real, and it does not state that any file is admissible in any proceeding. Anyone relying on it should re-verify it with the public receipt check or with standard cryptographic tools, and should read the checksum grade and the methodology version before drawing any conclusion.