Topic hub
Hash Verification & Integrity
How a cryptographic digest demonstrates that a file has not changed, what a matching value does and does not establish, and how chaining records together makes alteration detectable.
About hash verification & integrity
What a digest is
A cryptographic hash function reduces any amount of data to a short, fixed-length value. The same input always produces the same value, a single altered bit produces an entirely different one, and the value cannot be worked backwards into the data it came from. In evidence work that makes it a fingerprint: something you can write down, hand over, and compare again later without disclosing anything about what it describes.
What a match does and does not establish
A digest that re-computes to the value recorded at intake shows the content has not changed since that value was taken. It says nothing about who produced the file, whether its contents are true, or what it meant. It also says nothing about when the original value was recorded — a digest computed after a dispute began carries far less weight than one recorded at collection, which is why the timing of the record matters as much as the arithmetic.
Chaining records together
Recording the digest of each entry inside the entry that follows it links a log into a sequence. Altering an earlier entry changes its digest, which no longer matches the copy the next entry holds, and the break is visible for every entry after it. The precise claim is that alteration becomes detectable by anyone who re-runs the computation — not that a record cannot be edited. That distinction is the one an opposing expert will press on, and it is worth stating in exactly those terms.
CustodyTrack records the digest of an item as received and re-computes it on demand, with each entry chained to the one before it.
Published guides
Start here
How Cryptographic Hashing Makes Evidence Tamper-Evident
Answers the question “what is a hash value in digital forensics”.
SHA-256 for Evidence Verification
Answers the question “SHA-256 evidence verification”.
MD5 vs SHA-256 in Digital Forensics
Answers the question “MD5 vs SHA-256 digital forensics”.
Also planned for this hub
The full outline this subject is being written to, so you can see what is covered and what is still coming. The 10 titles below are not yet written and are not links.
- How to Prove a File Has Not Been Altered
- Explaining Hash Values to a Judge or Jury
- Hash Chains: How a Tamper-Evident Log Works
- Digital Signature vs Hash Value: What Each Establishes
- Blockchain for Chain of Custody: What It Adds
- How to Verify a Forensic Image Hash
- Write Blockers: What They Do and What They Demonstrate
- Trusted Timestamps: Proving When a Hash Was Recorded
- NSRL Hash Sets: Filtering Known Files in an Examination
- Chain of Custody in a Digital Forensics Lab Report
Each is listed above as a link once written — subscribe on the guide index to be told when they publish.
Common questions
- Why is SHA-256 preferred over older algorithms?
- Because the older functions have demonstrated collision weaknesses and SHA-256 does not. MD5 and SHA-1 can both be made to produce the same value for two different inputs, which is a fact an opposing expert can raise without having to show it happened in your case. Using the stronger digest removes that line of questioning at no practical cost. SHA-256 for Evidence Verification →
- Is MD5 still acceptable for evidence?
- It is still produced by a great deal of acquisition tooling, and an MD5 recorded years ago is not worthless. It is the weaker of the two values, though, and where both are available the stronger one belongs in the record. Re-computing a modern digest against material still held is usually cheap. MD5 vs SHA-256 in Digital Forensics →
- Why does the timing of the original hash matter?
- A digest shows only that content is unchanged since the moment the value was taken. If that moment came after the dispute arose, it demonstrates considerably less than one recorded at collection. This is the half of the argument most often skipped: the value and the time it was recorded are one fact, not two.
- How does a hash chain detect tampering?
- Each entry carries the digest of the entry before it. Change any earlier entry and its digest stops matching the copy the next entry holds, so verification fails from that point on and names where it broke. It makes alteration evident to anyone re-running the check; it does not stop someone editing a row, and the distinction is worth stating plainly.
Who this comes up for
- Corporate Legal, IT & eDiscoveryIn-house counsel, security and incident-response teams, and the eDiscovery function that inherits their collections.
- Private Investigators & DFIR ConsultantsLicensed investigators, one- and two-person digital forensics shops, and independent examiners retained by counsel.
Related subjects
- Chain of Custody
Who held an item, when, and what the record has to say about each handoff.
- Digital Evidence Admissibility
Authentication, the certification routes, and the exhibit types that draw the most argument.
- Evidence Handling Workflows
Collection through presentation, the guidance behind it, and who is accountable at each stage.
Reading about custody records is not the same as having one.
5 free Authenticated Chain of Custody Forms every month — no card required.