1C. Controlled documents and evidence
Keep binary evidence encrypted, immutable, integrity-hashed, classification-scoped and quarantined until malware scanning succeeds.
Purpose
Keep binary evidence encrypted, immutable, integrity-hashed, classification-scoped and quarantined until malware scanning succeeds.
Stores Officer, Quality Inspector, Security & Compliance Officer, Auditor
Two fictitious JPEGs named E2E-CA-DEMIL-BEFORE.jpg and E2E-CA-DEMIL-AFTER.jpg; certificate E2E-CA-COC-1042.pdf; RESTRICTED at the controlled test site.
Before you begin
- A versioned local keyring or AWS KMS-wrapped keyring is configured, with a separate stable RECOVERY_CODE_PEPPER
- For S3 acceptance, a dedicated private bucket and least-privilege workload identity are configured
- A ClamAV-compatible scanner is configured for acceptance testing
- Only fictitious, non-sensitive files are used
Evidence and malware-scanning concepts
A governed evidence record such as a certificate, test report, photograph, delivery note or authority. It has site, classification, retention and immutable-version metadata.
The exact uploaded bytes, filename, uploader, timestamp and SHA-256 hash. A replacement creates another version; it never overwrites the evidence already used by a transaction.
After permission, site, classification, file-type and size checks, Moduvio calculates SHA-256 and streams the file bytes to the private ClamAV service. The encrypted document, scanner result and scan time are retained. Only a CLEAN version can be downloaded or attached to an inspection or custody workflow.
ClamAV completed its current signature checks and reported no detected malware. CLEAN means the version may be used as evidence; it does not certify that the document's business content is correct.
A scanner was not configured or a scan has not completed. The document remains quarantined and cannot be downloaded or linked.
The scanner detected a malware signature. The encrypted file remains quarantined and unavailable for operational use; Security must investigate it under company incident policy.
The scanner was unreachable, timed out or returned an invalid result. Moduvio fails closed: the file remains quarantined rather than being assumed safe.
An authorised Security or Company Administrator rechecks the stored bytes. Moduvio decrypts them in memory, verifies the SHA-256 hash, streams them to ClamAV and records the new result.
Files sharing the same control metadata can be selected together. Each becomes its own immutable document and is scanned independently; an inspection may select multiple CLEAN versions.
ClamAV runs as a private service or scanner cluster with FreshClam signature updates and no public port. Larger deployments commonly use isolated quarantine storage and asynchronous workers, but the same fail-closed CLEAN-only rule applies.
Procedure
- 1
Choose the evidence type, site, classification and retention date. Select one or several files only when they share that control metadata.
- 2
Upload the files and review every independent scanner status. Do not continue to inspection merely because the upload request completed.
- 3
Use a CLEAN version only after verifying that its document type, site, classification, filename and SHA-256 belong to the intended transaction.
- 4
If a version is PENDING SCAN or SCAN ERROR, ask an authorised Security or Company Administrator to confirm scanner availability and use Rescan. Do not re-upload the same file just to bypass quarantine.
- 5
If a version is INFECTED, stop using it and follow the company's security-incident process; never download or link it to an operational record.
- 6
Upload a corrected or replacement file as a new immutable version and verify the original remains attributable.
- 7
As Auditor, confirm that upload, scan/rescan, download, linkage, legal-hold and archive actions retain their actors and timestamps.
- 8
For platform acceptance, separately exercise encryption-key rotation and PostgreSQL/S3 storage migration while verifying that plaintext SHA-256 remains unchanged.
Expected result
- Every selected file receives its own immutable version, SHA-256 and scanner result
- Scanner absence, timeout and error never produce CLEAN
- Only CLEAN same-site evidence at or below the user's and transaction's classification can be downloaded or linked
- A malware result controls technical file safety only; the responsible human still verifies certificate content and applicability
- Only AES-GCM ciphertext enters the object store and object keys contain no business metadata
- PostgreSQL and S3 versions remain downloadable, scannable, OCR-readable and key-rotatable during migration
- Legal hold prevents archive until explicitly released
- No destructive document/version delete action exists