Graphologist IsraelImaging and preservation
Retain the file as received and record who supplied it, when, and through which channel. Where appropriate and permitted, keep the message that carried an attachment. Work on a separate copy and record any conversion or cropping performed on it.
For example, a scan from an employee and a later PDF from a lawyer each need their own identifier. Matching SHA-256 hashes support byte-level continuity between two checks. They do not establish authorship or reveal events that occurred before the first check.