Within Verify Claims
Who Held the File Before You Saw It?
A hacked origin makes evidence harder to trust unless every copy, transfer, hash, and handling step can be explained.
On this page
- What chain of custody means for digital files
- Why hacked evidence is especially fragile
- A practical custody checklist for UFO claims
Page outline Jump by section
Introduction
When evaluating alleged UFO evidence obtained through hacking, one question often matters more than the content of the claim itself: who held the file before you saw it? In digital forensics, this is known as the chain of custody—the documented history of how evidence was collected, copied, stored, transferred, and examined. Without that history, even a genuinely unusual file can become impossible to authenticate. [NIST Publications]nvlpubs.nist.govDigital files are very easy to change, so maintaining the integrity of the data is a critical concern. (See also Section…Read more…
This issue is especially important in cases associated with hackers such as Gary McKinnon. McKinnon publicly described seeing unusual NASA imagery and a file listing “Non-Terrestrial Officers”, but the public has never been able to inspect original preserved copies of those materials. What remains is primarily testimony about what was seen rather than artefacts that can be independently verified. [WIRED]wired.comufo hacker tells what he foundWIRED'UFO Hacker' Tells What He FoundJun 21, 2006 — The search for proof of the existence of UFOs landed Gary McKinnon in a world of trou…
For UFO researchers, chain-of-custody failures are often the dividing line between a potentially testable digital artefact and an anecdote that cannot be reconstructed years later.
What Chain of Custody Means for Digital Files
A chain of custody is the documented record showing where evidence came from, who handled it, when it changed hands, and how its integrity was protected. In digital investigations, the goal is to demonstrate that a file examined today is the same file originally collected. [PMC+2SWGDE - SWGDE]pmc.ncbi.nlm.nih.govPMCThe Chain of Custody in the Era of Modern ForensicsThe latest guidelines regarding the establishment of digital evidence…
For digital evidence, that normally includes:
- The original source system.
- The date and method of collection.
- Cryptographic hashes (digital fingerprints) generated at acquisition.
- Records of every copy and transfer.
- Storage conditions and access logs.
- Identification of everyone who handled the evidence. [SWGDE - SWGDE+2SWGDE - SWGDE]swgde.orgSWGDESWGDE Best Practices for Digital Evidence CollectionThe chain of custody documentation should be contemporaneous to the coll…
Digital files are unusually fragile from an evidential perspective because they can be duplicated perfectly, edited invisibly, stripped of metadata, recompressed, renamed, or partially copied. As NIST notes, maintaining integrity is a central concern precisely because digital data is easy to alter. [NIST Publications]nvlpubs.nist.govDigital files are very easy to change, so maintaining the integrity of the data is a critical concern. (See also Section…Read more…
In UFO hacker cases, the chain frequently begins to break before evidence ever reaches the public.
Why Hacked Evidence Is Especially Fragile
The normal forensic process assumes evidence is collected deliberately and preserved immediately. Hacker-discovered material often follows the opposite path.
A typical UFO hacker narrative involves a person accessing a system, observing something unusual, leaving the system, and only later describing what was seen. By that point, several critical pieces of evidence may already be missing:
- The original file.
- System logs showing where it came from.
- Metadata.
- Hash values proving integrity. [swgde.org]swgde.orgWhen a file is hashed, a “digital fingerprint” of a file is created, which is unique to…
- Contextual files stored alongside it.
- Records of who subsequently accessed or modified it.
The result is a custody gap. Investigators know a claim exists, but cannot establish an evidential trail back to the source system. [NIST Publications+2PMC]nvlpubs.nist.govDigital files are very easy to change, so maintaining the integrity of the data is a critical concern. (See also Section…Read more…
This problem becomes even more severe when years pass between the alleged discovery and public discussion. Servers are replaced, logs expire, archives are reorganised, and witnesses’ memories evolve. What remains may be sincere recollection, but not necessarily verifiable evidence.
The Gary McKinnon Example
Gary McKinnon is one of the most frequently cited examples in UFO hacking discussions because he claimed to have encountered unusual material while accessing NASA and US military systems. He described seeing a high-resolution image of a non-human-looking craft and reported finding references to “Non-Terrestrial Officers” in a spreadsheet-like file. [WIRED+2WIRED]wired.comufo hacker tells what he foundWIRED'UFO Hacker' Tells What He FoundJun 21, 2006 — The search for proof of the existence of UFOs landed Gary McKinnon in a world of trou…
From a chain-of-custody perspective, however, several problems immediately arise.
No Public Original File
The alleged image was not preserved in a publicly available original format. McKinnon has stated that he did not capture the image before losing access. As a result, researchers cannot examine the file itself, calculate hashes, inspect metadata, or compare it against known NASA imagery. [Wikipedia]WikipediaGary Mc KinnonGary Mc Kinnon
Without the artefact, authentication becomes impossible.
No Preserved Acquisition Record
A forensic acquisition normally documents exactly where evidence came from. In this case, there is no publicly available forensic record identifying the original file path, storage location, system configuration, or acquisition procedure. [WIRED]wired.comufo hacker tells what he foundWIRED'UFO Hacker' Tells What He FoundJun 21, 2006 — The search for proof of the existence of UFOs landed Gary McKinnon in a world of trou…
Even if a copy later emerged, investigators would struggle to prove that it was the same file allegedly viewed during the intrusion.
Missing Transfer History
Chain-of-custody documentation requires tracking every transfer and custodian. In the McKinnon case, no public record establishes how the alleged materials moved from source system to preserved evidence because no preserved evidence has been produced. [PMC]pmc.ncbi.nlm.nih.govPMCThe Chain of Custody in the Era of Modern ForensicsThe latest guidelines regarding the establishment of digital evidence…
The practical consequence is that the claim cannot be independently reconstructed from available evidence.
The Difference Between a Story and an Artefact
A common misunderstanding in UFO discussions is that a witness account and a digital artefact carry similar evidential weight. They do not.
An artefact can be examined repeatedly by different analysts. A story about an artefact cannot.
For example, a preserved file allows investigators to ask:
- Does the metadata fit the claimed date?
- Does the file structure match known software?
- Has the file been edited?
- Does the hash remain consistent?
- Can independent experts reproduce the findings?
A remembered observation allows none of these tests. [NIST Publications+2SWGDE - SWGDE]nvlpubs.nist.govDigital files are very easy to change, so maintaining the integrity of the data is a critical concern. (See also Section…Read more…
This distinction explains why many UFO hacker claims remain unresolved. The debate often centres on what someone reported seeing rather than on evidence available for inspection.
How Custody Failures Create Alternative Explanations
Once custody is broken, alternative explanations multiply.
A researcher cannot confidently determine whether a file was:
- Original or copied.
- Complete or partial.
- Edited or untouched.
- Correctly interpreted or misunderstood.
- Associated with the claimed system at all.
Even honest witnesses can misidentify technical information when viewing unfamiliar systems under unusual circumstances. Missing custody records make it difficult to separate misinterpretation from genuine discovery. [NIST]nist.govprovenience based cross verification digital forensic artifacts applied ntfsProvenience-based cross-verification of digital forensic…by A Nelson · 2024 — The results of this general workflow form comprise a…
This does not prove a UFO claim is false. Rather, it means the available evidence cannot reliably distinguish among competing explanations.
A Practical Custody Checklist for UFO Claims
When evaluating alleged hacker-discovered UFO evidence, a useful first step is to ignore the extraordinary content and examine the custody trail.
Ask the following questions:
- Is the original file available? Not a screenshot of a screenshot, but the earliest preserved version.
- Was a hash generated close to acquisition? Hashes provide a way to detect later modification. [SWGDE - SWGDE]swgde.orgWhen a file is hashed, a “digital fingerprint” of a file is created, which is unique to…
- Can the source system be identified? Server, archive, database, directory, or storage location.
- Is there documentation of transfers? Who copied the file and when? [SWGDE - SWGDE]swgde.orgSWGDESWGDE Best Practices for Digital Evidence CollectionThe chain of custody documentation should be contemporaneous to the coll…
- Does metadata survive? Creation dates, software signatures, embedded properties, and file history.
- Can independent analysts inspect the same artefact? Verification requires more than a single witness.
- Is there corroborating system context? Logs, neighbouring files, archived references, or institutional records.
The more “no” answers a claim receives, the more it shifts from evidence evaluation toward witness evaluation.
Why Custody Matters More Than Sensational Content
The most dramatic UFO-related file imaginable would still require provenance. A document titled “Non-Terrestrial Officers”, a photograph of an unknown craft, or a secret database entry does not become trustworthy merely because it appears extraordinary.
In digital forensics, provenance often matters more than content. A mundane file with a documented acquisition path, preserved metadata, verified hashes, and an unbroken chain of custody can be stronger evidence than a spectacular claim with no surviving artefact. [NIST Publications+2NIST]nvlpubs.nist.govDigital files are very easy to change, so maintaining the integrity of the data is a critical concern. (See also Section…Read more…
For UFO hacker cases, that principle provides a practical rule: before asking what a file supposedly shows, establish whether anyone can demonstrate where it came from and who controlled it at every stage. Without that foundation, investigators are not examining evidence—they are examining a story about evidence.
Amazon book picks
Further Reading
Books and field guides related to Who Held the File Before You Saw It?. Use these as the next step if you want deeper reading beyond the article.
Digital Evidence and Computer Crime
Directly addresses chain of custody and integrity.
Incident Response & Computer Forensics, Third Edition
Explains evidence collection and preservation.
eBay marketplace picks
Marketplace Samples
Example marketplace items related to this page. Use the search link to explore similar finds on eBay.
Endnotes
-
Source: nvlpubs.nist.gov
Link: https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8387.pdfSource snippet
Digital files are very easy to change, so maintaining the integrity of the data is a critical concern. (See also Section...Read more...
-
Source: nist.gov
Link: https://www.nist.gov/forensic-science/interdisciplinary-topics/evidence-managementSource snippet
d that its chain of custody is tracked. The...
-
Source: wired.com
Title: ufo hacker tells what he found
Link: https://www.wired.com/2006/06/ufo-hacker-tells-what-he-found/Source snippet
WIRED'UFO Hacker' Tells What He FoundJun 21, 2006 — The search for proof of the existence of UFOs landed Gary McKinnon in a world of trou...
-
Source: Wikipedia
Title: Gary [Mc Kinnon]({{ ‘mc-kinnon/’ | relative_url }})
Link: https://en.wikipedia.org/wiki/Gary_McKinnon -
Source: pmc.ncbi.nlm.nih.gov
Title: PMCThe Chain of Custody in the Era of Modern Forensics
Link: https://pmc.ncbi.nlm.nih.gov/articles/PMC10000967/Source snippet
The latest guidelines regarding the establishment of digital evidence...
-
Source: swgde.org
Link: https://www.swgde.org/documents/published-complete-listing/18-f-002-swgde-best-practices-for-digital-evidence-collection/Source snippet
SWGDESWGDE Best Practices for Digital Evidence CollectionThe chain of custody documentation should be contemporaneous to the coll...
-
Source: swgde.org
Link: https://www.swgde.org/documents/published-complete-listing/18-f-002-best-practices-for-digital-evidence-collection/Source snippet
SWGDEBest Practices for Digital Evidence Collection - SWGDEAt a minimum, this documentation should include a chain of custody and...
-
Source: swgde.org
Link: https://www.swgde.org/documents/published-complete-listing/swgde-position-on-the-use-of-md5-and-sha1-hash-algorithms-in-digital-and-multimedia-forensics/Source snippet
When a file is hashed, a “digital fingerprint” of a file is created, which is unique to...
-
Source: wired.com
Title: terrorist or ufo truth seeker
Link: https://www.wired.com/2006/04/terrorist-or-ufo-truth-seeker/Source snippet
?Apr 28, 2006 — But Briton Gary McKinnon says he is just an ordinary computer nerd who wanted to find out whether aliens and UFOs exist...
-
Source: nist.gov
Title: provenience based cross verification digital forensic [artifacts]({{ ‘artifacts/’ | relative_url }}) applied ntfs
Link: https://www.nist.gov/publications/provenience-based-cross-verification-digital-forensic-artifacts-applied-ntfsSource snippet
Provenience-based cross-verification of digital forensic...by A Nelson · 2024 — The results of this general workflow form comprise a...
-
Source: wired.com
Title: WIRE D
Link: https://www.wired.com/Source snippet
The Latest in Technology, Science, Culture and...We bring you the future as it happens. From the latest in science and technolog...
-
Source: wired.com
Title: british ufo hac
Link: https://www.wired.com/2008/07/british-ufo-hac/Source snippet
ker Gary McKinnon Is Coming to AmericaJul 30, 2008 — Threat Level extends its warmest welcome to hacker Gary McKinnon, who just lost his...
-
Source: nist.gov
Link: https://www.nist.gov/Source snippet
National Institute of Standards and TechnologyNIST promotes U.S. innovation and industrial competitiveness by advancing measurement scien...
-
Source: csrc.nist.gov
Title: govchain of custody
Link: https://csrc.nist.gov/glossary/term/chain_of_custodySource snippet
of custody - Glossary | CSRCA process that tracks the movement of evidence through its collection, safeguarding, and analysis lifecycle b...
-
Source: csrc.nist.gov
Title: govdigital forensics
Link: https://csrc.nist.gov/glossary/term/digital_forensicsSource snippet
forensics - Glossary | CSRCThe application of computer science and investigative procedures involving the examination of digital evidence...
-
Source: swgde.org
Link: https://www.swgde.org/documents/published-complete-listing/05-f-001-swgde-digital-multimedia-evidence-glossary/Source snippet
SWGDE Digital & Multimedia Evidence GlossaryChain of Custody. The chronological documentation of the movement, location and possession of...
-
Source: swgde.org
Link: https://www.swgde.org/documents/published-complete-listing/23-q-001-best-practices-for-personnel-presenting-digital-evidence-in-legal-proceedings/Source snippet
wledge, skills, and abilities investigators/digital forensic examiners need to present...Read more...
Additional References
-
Source: interpol.int
Link: https://www.interpol.int/content/download/16243/file/Guidelines_to_Digital_Forensics_First_Responders_V7.pdfSource snippet
GUIDELINES FOR DIGITAL FORENSICS FIRST...Handle evidence according to agency policy and maintain a chain of custody. • Preserve the stat...
-
Source: vps.net
Link: https://www.vps.net/blog/historic-hacks-gary-mckinnon/Source snippet
Historic Hacks: Gary McKinnon – BlogIn our Historic Hacks segment, we like to look back at internet events that shocked, surprised, or ho...
-
Source: malicious.life
Link: https://malicious.life/episode/us_vs_gary_mckinnon/Source snippet
The US vs. Gary McKinnonGary McKinnon, a British hacker with Asperger's, broke into NASA & U.S Army networks - to find evidence of UFO co...
-
Source: researchgate.net
Link: https://www.researchgate.net/publication/386361522_Digital_Evidence_Chain_of_Custody_Navigating_New_Realities_of_Digital_ForensicsSource snippet
(PDF) Digital Evidence Chain of Custody: Navigating New...Dec 3, 2024 — In digital forensic practice, integrity is typically ensured thr...
-
Source: spreaker.com
Title: gary mckinnon the hacker who found nasa s ufo non terrestrial officers 70473181
Link: https://www.spreaker.com/episode/gary-mckinnon-the-hacker-who-found-nasa-s-ufo-non-terrestrial-officers–70473181Source snippet
Gary McKinnon: The Hacker Who Found NASA's UFO &...5 Mar 2026 — This episode is a casual, banter-filled deep dive into Gary McKinnon's N...
-
Source: welivesecurity.com
Title: gary mckinnon reveals detail on nasa data breach and extraterrestrial life
Link: https://www.welivesecurity.com/2015/12/08/gary-mckinnon-reveals-detail-on-nasa-data-breach-and-extraterrestrial-life/Source snippet
Gary McKinnon reveals detail on NASA data breach and '...Dec 8, 2015 — IT expert and so-called hacker Gary McKinnon has claimed in an in...
-
Source: youtube.com
Link: https://www.youtube.com/watch?v=WFd7XzTf6_kSource snippet
David Grusch & NASA Hacker Gary McKinnonThe story of how a hacker breached NASA security with the intention of proving that NASA is hidin...
-
Source: youtube.com
Link: https://www.youtube.com/shorts/OFfQo4HkGp0Source snippet
NASA Hacker Found Alien Officers List...Gary McKinnon, the hacker who broke into NASA, claimed to have found evidence of UFOs and a secr...
-
Source: youtube.com
Link: https://www.youtube.com/watch?v=vimQuaC3RYMSource snippet
Understanding Chain of Custody in Digital ForensicsChain of custody refers to the documented process of collecting handling and preservin...
-
Source: lcgdiscovery.com
Link: https://lcgdiscovery.com/beyond-the-screen-part-6-video-evidence-under-the-microscope-metadata-and-manipulation/Source snippet
Body-worn cameras. Prosecutors and agencies now have guidance that pairs policy with evidence practice...Read more...
Topic Tree