UniFi Protect 7.2 Evidence Verification: Was This Video Altered?

UniFi Protect evidence verification can help show whether an exported security-camera clip changed after capture. Protect 7.2 adds cryptographic fingerprints, digital signatures, case-management records, and audit trails for views and downloads. Those are meaningful evidence-handling improvements.

They do not make every clip automatically admissible in court. A Pueblo contractor, Colorado Springs retailer, or Fountain manufacturer still needs a written process for who exported the video, where it was stored, who received it, and what happened to the original.

What UniFi Protect evidence verification can prove

Ubiquiti says the Protect 7.2 Evidence System can create a SHA-256 cryptographic fingerprint and digitally sign a clip at capture. A valid result at evidence.ui.com supports two narrower claims: the file originated from an enrolled Protect system, and its contents still match the signed capture-time fingerprint. An altered file is flagged.

The release also adds case management that records who viewed a case, which assets were accessed, and what evidence was downloaded. That audit trail helps connect the file to the people and actions around it.

NIST defines a hash value as a numerical string used to substantiate the integrity of digital evidence. If the file changes, its calculated hash changes. That is what makes hashing useful for showing that the reviewed copy still matches the exported file.

What UniFi Protect evidence verification cannot prove

A matching hash can show that a file still matches the fingerprint created at capture. It does not prove the event happened as someone describes it, the camera was aimed correctly, the date and time were accurate, the clip includes every relevant moment, or the person exporting it followed company policy.

It also does not replace a witness or custodian who can explain the system and the handling. The National Institute of Justice advises that collection, examination, storage, and transfer actions should be documented and should preserve the integrity of digital evidence.

Ubiquiti's current verification workflow instructs the recipient to submit the MP4 or ZIP to its verifier. Before using that workflow for sensitive workplace, customer, or criminal footage, confirm how the file is handled and whether company policy, law enforcement, an insurer, or counsel requires a different approved process.

Think of the signature as one strong link. The chain still includes the camera, recorder, account permissions, export action, storage location, transfer, and people who handled the file.

Evidence workflow before an incident

A practical business process should identify who can export video, who receives incident requests, where original exports are stored, and how the business records each transfer. Limit broad administrator access and keep individual user accounts so actions can be attributed.

When an incident occurs:

1. Preserve the relevant time range and identify the cameras involved.
2. Record the date, time, timezone, recorder, camera names, and person performing the export.
3. Export the clip using the evidence feature and retain the original package unchanged.
4. Store the original in a controlled location rather than texting the only copy. Create separate working or delivery copies for trimming, annotation, or conversion, and record which original they came from.
5. Record who receives a copy, when, and for what purpose.
6. Let law enforcement, counsel, an insurer, or another authorized party direct any formal forensic handling they require.

That last step matters. GTZ can configure the camera system and help preserve technical records. We are not the attorney deciding admissibility or the forensic examiner certifying a criminal case.

Cryptographic verification can show that the exported file stayed intact. It cannot document the human decisions nobody recorded.

Case management is useful even when court is not involved

Most security-camera investigations never reach a courtroom. Businesses review workplace incidents, vehicle damage, deliveries, access events, safety concerns, inventory loss, and customer disputes.

A case workspace helps keep related clips and access history together. It can reduce the familiar mess of renamed files in email threads and downloads folders. The audit trail also helps answer a basic management question: who viewed or downloaded sensitive footage?

Where the camera system still matters

A signed blurry clip is still blurry. Evidence verification does not fix a camera mounted too high, a washed-out doorway, an unreadable plate, poor retention, or a recorder that ran out of space before the incident.

The system design has to capture identification-quality footage where identification is required. The retention plan has to keep it long enough for the incident to be discovered. The time source has to be correct. The accounts have to remain controlled.

The earlier ONVIF migration article explains how third-party cameras fit into Protect. Our physical security service starts with camera purpose and the locations where identifying detail is required, not a camera count alone.

Frequently asked questions

Does a valid Protect signature guarantee a court will accept the video?

No. It strengthens the technical integrity story, but authentication and admissibility depend on the evidence, process, testimony, and applicable rules.

Can an altered clip still be played?

Possibly, but Protect's verification process is designed to flag a mismatch between the file and its signed fingerprint.

Should we email the original evidence file?

Keep a controlled original and distribute copies through an approved process. Email may be part of delivery, but it should not be the only archive or chain record.

Does this work without good user accounts?

The feature can still create signatures, but individual accounts and limited permissions make the case audit trail much more meaningful.

GTZ sells and installs UniFi Protect, so we benefit if a client chooses it. Good evidence still requires correct camera placement, storage, permissions, and procedure. No software release removes that work.