Scope
Cover live and static acquisition, storage controls, digest comparisons, timestamps, custody events, and derived evidence. Preservation of a file is distinct from preservation of the complete environment needed to interpret it.
Questions worth testing
- What object was originally acquired?
- Which transformations created each working copy?
- Can a custody gap or digest mismatch be explained and documented?
Evidence and study material
Source inventories, collection notes, byte lengths, cryptographic digests, transfer receipts, storage logs, and analysis manifests help maintain traceability. Keep the original object and the derived object separately identified.
Methods to begin with
Limits on interpretation
A matching digest demonstrates byte equality under the selected algorithm; it does not establish origin, completeness, or truth. Ordinary file times can change during copying and need interpretation within their source system.
Open research questions
Research priorities include cloud export completeness, reproducible derivations, and custody across automated agent workflows. Tests should include failures and interrupted transfers, rather than document only successful paths.
Tools, projects, datasets, and publication
Release hashes and source archives provide concrete project examples of versioned integrity records. The Artifact Report schema supports comparable observations; no case evidence repository exists. Journal work should make redactions and unavailable originals explicit.
How do you separate preservation from truth?
Acquire an object with a documented scope and compare its bytes through appropriate integrity checks. Preserve handling and derivation records. Then examine the proposition its contents are used to support through source context and independent evidence.
An unchanged file can contain an inaccurate statement or fabricated scene. Integrity supports the history of the acquired representation; authenticity and factual interpretation remain separate questions.
Sources & further reading
Source verification checks the official publication and its scope. It is separate from independent technical review of this reference page.
- NIST SP 800-86: Guide to Integrating Forensic Techniques into Incident Response
IT-oriented forensic process and sources; published 2006. It is not a complete investigative procedure or legal advice.
- FIPS 180-4: Secure Hash Standard
Cryptographic digest algorithms, including SHA-256. The official page records a planned revision; a digest alone does not authenticate an origin.
- RFC 3161: Time-Stamp Protocol
A signed time-stamp token protocol. Evaluate the authority, token, and applicable updates; a file’s ordinary timestamp is different.
Canonical reference: https://syntheticforensics.org/research/evidence-integrity/
Report a technical correction