Evidence integrity is often reduced to a matching hash. That comparison is valuable, but a reviewer also needs to know whether the item is what it is claimed to be, whether the collection covers the relevant material, and how the item was handled. Keep these questions separate so a strong result in one area does not conceal a gap in another.
Four questions, four kinds of support
| Question | Useful support | Remaining limit |
|---|---|---|
| Integrity: did the defined object change? | Recorded digests, controlled derivatives, transformation history | Unchanged bytes can contain misleading content. |
| Authenticity: is the item what the claim describes? | Source context, native records, corroboration, relevant verification | A believable appearance does not establish origin. |
| Completeness: what relevant scope was collected? | Acquisition logs, source inventory, exceptions, coverage checks | An intact partial export remains partial. |
| Custody: who handled the item and when? | Item identifiers, transfers, access and storage records | Possession records do not independently establish content truth. |
The Evidence Integrity field-manual entry and Chain of Custody entry remain the site's foundation references. This comparison adds a claim-review method: ask which question each offered check addresses before describing its overall significance.
Define the bytes before comparing hashes
NIST FIPS 180-4, published August 2015 specifies secure hash algorithms and describes digests as a way to detect message changes. For an evidence comparison, record the algorithm, object identifier, size, and stage at which each digest was calculated. “SHA verified” is incomplete when a reviewer cannot tell whether the input was a whole image, archive, extracted file, or rendered report.
A compressed archive and its extracted contents are different byte sequences. A converted document and its received version can preserve some visible content while differing as files. Compare like with like and record intentional transformations. If digests differ, investigate the cause instead of treating the mismatch alone as proof of malicious interference. If they match, state the defined comparison without extending it to untested origin or coverage claims.
Test authenticity through a specific claim
Replace “this evidence is authentic” with the proposition being assessed. Is it a native export from the stated account, the file received in a particular communication, or a representation of a real event? Preserve the acquisition context and records connecting the item to that proposition. A screenshot can truthfully depict an interface while leaving the underlying source incomplete. A signed object still needs an explanation of what the verification procedure checks.
Review completeness against the question
List requested sources, accounts, periods, object types, and known exceptions. Then reconcile that list with the delivered material. A cloud job may finish successfully while applying a narrow query. A disk image may preserve its accessible range while excluding another device. Define the relevant scope before using the word complete, and identify unavailable material that could change the conclusion.
Keep handling and derivation connected
Give original items and working copies stable identifiers. Record transfers and the relationship between each derivative and its parent. Document access, storage location, dates, and relevant changes under the organization's normal process. A hash can help connect the bytes at a transfer; it does not tell a reviewer who possessed the item between two checks. A custody gap and an unexplained content change are different observations requiring different follow-up.
Report the result at the right level
As a hypothetical review example, consider an export whose received and working-copy hashes match, with a documented transfer between examiners. If the export request covered only one account, the matching bytes and custody record do not establish coverage of other accounts. If its native source was never independently established, the same checks also leave that origin question open. Record each supported result and each missing dependency separately.
Use a short finding for each question: the compared objects and result; the source relationship supported; the collected scope and gaps; and the handling record available. Explain unresolved issues where they affect an inference. The acquisition-verification guide provides the practical next step for manifests and working copies. This page supplies an original review framework, not an experiment, universal authenticity test, or legal assessment.