There's a gap between "accused" and "has a lawyer and an examiner". It can be weeks, and short-retention stuff dies in it. This tool only covers the person's own sources: own device, own exports, receipts. Anything examiner-grade (deleted data, locked devices, full extractions) gets routed to counsel. The tool doesn't do that part.

freeze copies a source the user owns, hashes it and writes a manifest. It doesn't claim to prove anything beyond "this copy hasn't changed since it was made".

What I'd like you to poke at:

• Read-path safety. We treat "capturing it leaves a trace" as a shipping gate: read receipts, auto-joins, tracked links, login alerts. What are we missing?
• Self-collection. How would you attack a self-collected copy on the stand?
• Intimate media. If the user flags a source, freeze refuses without opening, listing or hashing anything. It can't detect the class itself, though. How would you close that without looking?

https://github.com/machinewitness/machinewitness. Don't be nice about it.