Why Evidence is immutable and how archive/restore works

NearbySpy treats Evidence the way a forensics lab treats samples. Once captured, the artifact does not change. You can stop showing it, you can move it out of view, you can recover it later — but you cannot edit it in place, and you cannot quietly delete it. This article explains why, and what archive and restore actually do.

What "immutable" means here

An immutable file is one whose stored bytes never change after the moment of upload. NearbySpy enforces this in a few specific ways:

• You cannot replace a file in an existing Evidence card. The card is bound to one set of bytes, identified by a SHA-256 hash recorded at upload time.
• You cannot rename, crop, rotate, or otherwise edit the underlying file inside NearbySpy. Annotation and markup happen in your tool of choice; the annotated copy is a new upload with its own hash and audit entry.
• The integrity check described in How Evidence upload and integrity work means any attempt to modify a stored file would surface immediately as a hash mismatch.

If a file is wrong — wrong Subject, wrong date, wrong angle — you upload the correct file as a new Evidence card and archive the wrong one. The Activity log will show both events.

Why immutability matters

PI work is legally sensitive and frequently ends up in front of someone who will challenge it. Defensible Evidence has three properties: it is what it claims to be, it has not been altered since capture, and there is a clear record of who handled it. Immutability is what lets NearbySpy answer the second question honestly. The hash recorded at upload is the same hash you can verify months or years later.

Mutable storage — where files can be edited in place — cannot offer that guarantee. Even with the best intent, an "edit" is indistinguishable from tampering once the original bytes are gone. NearbySpy refuses that risk by design.

Archive instead of delete

The standard way to remove Evidence from view is to archive it. Archiving is a soft action: the Evidence card is hidden from the Operation gallery and from any Client view, but the underlying file, hash, uploader, and audit history are preserved. Archived Evidence still counts toward the Case's complete record.

Only Case Owners and Admins can archive Evidence. Investigators and Viewers cannot. This is part of the broader role model in Case roles: Owner, Admin, Investigator, Viewer, Client.

Restore

Anything in the Archive can be brought back. An Owner or Admin opens the Archive view, finds the Evidence, and restores it. Restored Evidence reappears in its original Operation gallery with the same hash and the same uploader information it had before. The archive and the restore both produce Activity log entries, so the back-and-forth is visible to anyone reviewing the Case.

What Clients see

Clients never see archived Evidence. The moment you archive an item, it disappears from the Client view of any Operation it was on. If you later restore it to an Operation that is shared with the Client, it becomes visible again. To control which Operations a Client sees in the first place, see Controlling what Clients see on Operations.

What is not supported, on purpose

• There is no hard delete from the user interface. Permanent deletion only happens through retention policy, not on demand.
• There is no way for a single member — even an Owner — to silently remove Evidence without an Activity log entry.
• There is no way to overwrite an existing Evidence card with new bytes. Always upload a new card.

If you need to handle a legitimate legal hold, takedown, or data-subject request, contact NearbySpy support through the channel described in Contact form reasons and what to include.