Checksums, MHL, and never copying a card twice

The most dangerous minute of a shoot day is the one where somebody formats a card. Everything else on set has an undo. The card comes in at lunch, it has to be back in a camera by six, and between those two moments the only thing standing between you and reshooting a morning is whatever your offload actually proved. So treat offload as chain of custody, not as a file copy that happens to be important.

A progress bar is not evidence

"It copied fine" means a progress bar reached the end and nothing complained. That is a statement about the copy process, not about the bytes. Write caches report success before anything is on the platter. Card readers in their third season of set life flip bits without a word. A NAS under load drops a write and says thanks. The failure worth fearing is not the loud one; it is the file that exists at the destination, opens normally, and carries a green flash of corruption in the only take the director circled. You find out in the edit, weeks after the card was wiped, which is another way of saying you find out never. The bar also says nothing about the read side: a card half-dying in the reader can hand over garbage that then copies perfectly.

Verify both ends or you verified nothing

Verification means content, on both ends. Hash the file as it streams off the card. Write it, force it to the physical disk, then read it back from the destination, uncached, and hash it again. When the two numbers match you hold evidence; anything less is trust with extra steps. ClipLogger's default mode goes one further and re-reads the source a second time, uncached, as a stability check on the card itself, because a flaky card that returns different bytes on two reads should be caught, not archived. Any mismatch fails that file closed, and a card carrying a failure is never called safe to wipe. If you use another tool, hold it to the same bar, and know that a size-only comparison is not verification, it is optimism with a checkbox.

The manifest is the receipt

A checksum that lives in an app's memory dies with the session. Write it down: an ASC-MHL manifest at each destination listing every file, its size, and its hash. Now the archive can be audited without the source card, forever. A year later, when a producer asks whether the NAS copy of the finals is intact, you re-verify against the manifest and answer in minutes, with proof instead of a shrug. ClipLogger writes one per card at every destination and can re-check a copy against it later, no source card required. Insurance asks for this. Broadcast deliverables increasingly assume it. And the person it serves most is future you, staring at a drive labeled FINALS 2019, wondering what can still be trusted. A copy without a manifest is a rumor with good intentions.

Two destinations, then the wipe

One verified copy still leaves your footage a single failure away from gone. The old rule stands: never on fewer than two media before the card dies. Make it policy instead of vibes: the card is wipeable when the required number of verified destinations exist, and the software should refuse to call it safe until then. ClipLogger defaults to two and copies in tiers, fast SSD first so the card frees early while the NAS copy trickles in behind it, and the wipe verdict always re-checks that the copies exist now, not that they existed once in a log somebody scrolled past. One more rule that sounds pedantic until it saves you: an empty card is never called safe, because there is nothing to certify, and "safe" has to mean something.

The quiet superpower: refusing a card

The underrated feature in all of this is refusal. Cards go back in the bag un-wiped, come out again on Thursday, and someone dutifully copies 128 GB that already exists into a second folder that somebody else gets to dedupe in January. A tool that keeps a manifest memory recognizes the card on sight and says so: already ingested, and here is where the verified copies live. Run it again anyway and identical content is skipped, while a different file that happens to wear the same name is written alongside and flagged, never overwritten. Refusing work is the feature, and it doubles as your dedupe policy, enforced at the door instead of remembered in January. An offload tool should know what it has already proven and decline to spend your afternoon proving it again.

Wipe on evidence, never on a progress bar.