Evidence Integrity & Hashing
What is it?
Evidence integrity means being able to PROVE the evidence you analyzed is exactly what was collected, unmodified. The core mechanism is cryptographic hashing: compute a hash (e.g. SHA-256) at acquisition, work only on copies, and re-verify the hash whenever integrity is questioned.
Why it matters
A finding from evidence that cannot be shown unmodified can be dismissed entirely — the strongest analysis in the world collapses if the input's integrity is doubted.
Where you see it
The acquisition log of every professional case: image hash recorded at collection, verified after copying, verified again before the report.
What normal looks like
Matching hashes at every verification point; analysis performed on working copies while the original sits untouched.
What suspicious looks like
A hash mismatch — which does not say WHO changed what, only that the evidence can no longer be presented as pristine.
How analysts investigate
By hashing at acquisition, documenting the value, analyzing copies, and re-hashing to demonstrate the original never changed.
Common beginner mistakes
- Analyzing the original evidence directly 'to save time' — one accidental write and the entire case's integrity is gone, unrecoverably.
Wadi's analyst images the warehouse laptop's disk and records: SHA-256 = 7f3a…9c21. Three weeks later, legal asks whether the image could have been altered during analysis. The answer takes ten seconds: re-hash the original, compare. Match — provably untouched. That ten-second answer only exists because of a ten-second habit at acquisition.
Quick check
An image hashed at acquisition later produces a DIFFERENT hash. What does this prove?
A quick self-check — it doesn't affect your XP or progress.
Sign in to save your progress on the server.