Capturing Evidence
Storage, hashing, and chain of custody for findings.
Capturing Evidence
Evidence is the proof behind a finding. Screenshots, packet captures, log excerpts, command output. ATHELOS stores it, hashes it, and links it to the findings it supports.
Why evidence matters
A report says "SQL injection found in the login form." Evidence shows:
- The exact request that triggered it
- The response that proved the injection
- The database dump that demonstrated impact
Without evidence, a finding is an assertion. With evidence, it's a fact the client can verify.
What counts as evidence
Anything that demonstrates a finding:
| Type | Examples |
|---|---|
| Screenshots | Burp Suite showing an HTTP response, terminal output |
| Network captures | pcaps from Wireshark or tcpdump |
| Log excerpts | Server logs showing the exploitation attempt |
| Command output | Terminal sessions demonstrating access |
| Files | Extracted configuration files, database dumps |
| Text notes | Raw output pasted as a text file |
If it proves something about the finding, it can be evidence.
Uploading evidence
Inside a finding, scroll to the Evidence section. Click Upload.
Select a file from your machine. ATHELOS:
- Computes a SHA-256 hash of the file contents
- Uploads the file to MinIO object storage
- Records the hash, size, mimetype, and timestamp
- Links the evidence to the finding
The upload completes in under a second for typical files.
The SHA-256 hash
Every evidence file is hashed with SHA-256. This is important for two reasons:
Integrity — the hash proves the file hasn't been modified since it was uploaded. If the client asks "has this been altered?", the hash answers.
Chain of custody — for forensic work, the hash documents the moment evidence was captured. Combined with the timestamp and the operator who uploaded it, this forms a chain of custody that's defensible in court.
The hash appears on the evidence item. You can copy it and include it in the report if needed.
Viewing evidence
Click any evidence item to preview it inline. Images render directly. Text files show as syntax-highlighted content. Other files offer a download.
The preview uses the same storage the file was uploaded to — no external services, no temporary URLs that leak.
Downloading evidence
The evidence detail view has a Download button. The file downloads with its original filename and mimetype.
Downloads are logged. You can see who downloaded what and when in the audit trail.
Attaching multiple files
A finding can have any number of evidence files. Group them logically:
- One evidence item for the injection proof
- Another for the impact
- Another for the remediation verification
Order doesn't matter — the client sees them all.
Removing evidence
To delete an evidence item, open it and click Delete. You'll be asked to confirm.
Deletion is permanent. The audit log records the deletion and the hash of what was removed.
If you want to keep an evidence file but hide it from the report, that's a report-level decision — leave the evidence attached and exclude the finding from the report, or don't include the specific evidence in the deliverable.
Evidence across engagements
Evidence is scoped to its finding. It doesn't cross engagements — a screenshot from last month's engagement isn't visible in this one.
This keeps client data isolated between engagements. If you need to reference old evidence, you open the old engagement.
Storage
Evidence is stored in MinIO. In a local install, MinIO runs in Docker on your machine. In production, it's a MinIO instance on your own infrastructure.
Nothing leaves your infrastructure. No cloud storage. No third-party CDN. The file lives on hardware you control.
Backups
Evidence is included in the automated restic backups. See Scheduled backups for how this works.
Where to go next
- Managing findings — the finding lifecycle
- Generating reports — using evidence in reports
- Scheduled backups — protecting evidence