A hash proves one precise thing: integrity after the value was recorded. It does not prove when a capture happened (that is the timestamp's job, with its source documented), and it does not prove that the underlying online content was authentic, true, or created by a particular person. Claiming more than that overstates what the mechanism supports. The useful discipline is to pair the hash with source context: the URL, the capture method, the account identifiers, and the custody events around it, so a reviewer can judge the whole record rather than one number in isolation.
In an online-harm evidence file, SHA-256 is typically computed twice: once for each original captured file, and again for any bundle or export produced later, so a recipient can verify that what they received matches what was recorded at capture. The hash sits inside the custody log as one entry among several, not as a standalone proof of anything. Reviewers who ask "does a hash make this admissible?" are asking the wrong question; a hash supports one narrow integrity claim inside a wider, source-aware record that counsel still has to assess.
Finium computes SHA-256 hashes at capture where tooling allows and carries that value through the chronology, the custody log, and any exported bundle, so a law firm receiving a file can check that nothing changed silently between capture and delivery.