For newsrooms: how to verify footage recorded with Witness in ten minutes

What to ask for, three checks, and what each result means.

A contributor says they recorded something with Witness. This page is for the desk that has to decide what that is worth. The checks use standard OpenSSL and a hashing command, not the app, and do not depend on trusting the contributor or the developer. This guide is written by the developer of Witness Camera, so read it with that in mind. Everything about other tools comes from their own sites and store listings, and where Witness is the weaker choice, it says so.

Short answer. Ask the contributor for the whole Witness session folder (the video files, manifest_.json and timestamp_.tsr), shared by link rather than forwarded through a messaging app that re-encodes video. Hash each video with SHA-256 and compare it with the manifest, run openssl ts -verify on the manifest with the time-stamp authority's CA certificate, then read the token. A pass shows the files are unchanged since the manifest was time-stamped. It does not show what the footage depicts, so geolocation, corroboration and sourcing still apply.

What to ask the contributor for

The whole session folder, not a clip: the video files, manifest_<session-id>.json and timestamp_<session-id>.tsr.
Shared by a link to the storage account (Google Drive, Dropbox, Nextcloud) or a direct download, not forwarded through WhatsApp or similar. Re-encoding changes the file, so its hash will no longer match, and that is a mismatch caused by the channel, not by tampering.
Ideally with the contributor's name, the time and place they say it was recorded, so you have a claim to test the record against.

Check 1: do the files match the manifest?

shasum -a 256 recording_rear.mp4        # macOS and Linux
certutil -hashfile recording_rear.mp4 SHA256   # Windows

Open the manifest. Every chunk has a sha256 field, and consolidated videos appear under mergedVideos. The values must match exactly. The manifest also lists capture start and end times in UTC and the GPS coordinates with their accuracy for each chunk.

Check 2: is the manifest authentic and dated?

openssl ts -verify \
  -data manifest_<session-id>.json \
  -in timestamp_<session-id>.tsr \
  -CAfile <authority-ca-cert>.pem

A pass prints Verification: OK. The manifest names the time-stamp authority in its timestampAuthority field, and the CA certificate comes from that authority's website. A failure here is most often a missing or wrong CA certificate, a local configuration problem, so read the token before concluding anything.

Check 3: what did the authority actually attest?

openssl ts -reply -in timestamp_<session-id>.tsr -text
shasum -a 256 manifest_<session-id>.json

Confirm that the digest in the token equals the SHA-256 of the manifest file. If it does, a third party with no stake in the matter signed this exact manifest, unmodified, at the time shown. Because the manifest lists every file's hash, that proof extends to the footage.

What a pass does and does not establish

It establishes that the footage existed in this form at that time and has not changed since.
It does not establish what the footage shows, or that it was recorded when it appears to have been: only that it cannot postdate the time-stamp.
Capture times come from the device clock and are corroborated, not replaced, by the token. Locations come from the phone's GPS and inherit its accuracy.
A missing manifest or token means the material is unverified by these means, not that it is false. If the authority was unreachable when the session ended, there is no token.
Witness does not use C2PA content credentials. Its provenance is the manifest and the RFC 3161 token.

What the desk still has to do

Everything a verification desk normally does: geolocate and chronolocate from the picture, corroborate with other sources, check the contributor, and consider context. The record narrows one question, whether the file is what was recorded. For wider practice, see the WITNESS organisation's guidance on video as evidence and the Berkeley Protocol on Digital Open Source Investigations, both of which stress authenticity and chain of custody. WITNESS is an unrelated human-rights organisation, not this app.

Questions

How do I verify footage recorded with Witness?

Get the whole session folder, hash each video with SHA-256 and compare with the manifest, run openssl ts -verify on the manifest with the time-stamp authority's CA certificate, and read the token to confirm its digest matches the manifest.

Why does the hash not match the video I was sent?

Most often because the video was re-encoded, which messaging apps and social platforms do automatically. Ask for the original files through a link to the storage account.

Does a verified Witness recording prove the footage is genuine?

No. It proves the footage existed in this form at that time and has not been altered since. It does not prove what it depicts, so normal verification still applies.

What if there is no time-stamp file?

The authority was probably unreachable when the session ended. That is a gap in corroboration, not a sign of tampering. The hashes can still be checked against the manifest.

Try it free first

The free app already has the parts that protect and verify footage. Pro is unlocked from inside it, and its controls are visible before you pay.

Get Witness Camera for Free Get it on Google Play

More guides by profession

Written on 27 October 2026. Features and prices change. This is not legal advice.