Anti-ForensicsRendering Digital Investigations Irrelevant
Reference Library · Investigation notes

Verify an acquisition and its working copies

Connect scope, acquisition records, hash comparisons, and transfers to the claim you need to support.

Materially reviewed · Original editorial guide

2 minute read · Source-based editorial synthesis
On this page
  1. Define the unit you are preserving
  2. Build a useful manifest
  3. Verify transfers and derivatives
  4. Check completeness separately
  5. Sources and working records

Verification asks whether the collected material and its later copies meet the stated acquisition goal. A matching hash is evidence about equality of hashed bytes. It does not establish that the right source was selected, that collection was complete, or that the source was truthful before collection.

Define the unit you are preserving

Record whether the output is a physical image, a logical export, a selected file set, or a service-generated download. Identify the source device or account, collection boundaries, time range, tool version, and relevant settings. For a live collection, note activity that could change the source while collection runs. Do not promise bit-for-bit equivalence where the method does not support it.

Build a useful manifest

Assign a stable evidence identifier and list the acquired outputs with their sizes and hash algorithm. Record acquisition start and end times with offsets, operator reference, errors, and missing material. If a format has multiple segments or companion files, keep the complete set and the tool's own acquisition log. A hash manifest must identify exactly which bytes or files each value describes.

Verify transfers and derivatives

  1. Preserve the original acquisition outputs under controlled handling and create documented working copies.
  2. Calculate hashes over the same defined inputs before and after a transfer, using the recorded algorithm. Investigate a mismatch before continuing as if the copy were equivalent.
  3. For an extracted object, record the parent image or export, extraction method, and its new hash. A derivative's different hash is expected when its bytes differ; explain the relationship.
  4. Keep handling records alongside content checks. A digest does not record possession, access, or the authority for collection.

Check completeness separately

Compare expected partitions, file counts, account scope, and time ranges to acquisition logs and the question. Document unreadable sectors, skipped files, API limits, or access restrictions. A successful command exit is not a completeness test. When validation is important to a conclusion, examine a known input or use a suitably independent method.

Sources and working records