Hashes can show evidence stayed unchanged
Fingerprinting evidence when you collect it lets you prove later that it has not been altered since.
Recompute the hash, compare, and either it matches or something happened. It is simple, cheap and the difference between evidence that withstands challenge and evidence that is merely your word. It also protects you: it demonstrates that your own analysis did not change anything.
More on Digital forensics
- Forensic copies protect original evidenceMark the copy, never the original
- Timestamps need interpretationOne moment, three different times
- Memory can reveal what disk cannotIt has to unwrap itself to run
- Forensic tooling can change the thing examinedYou leave prints of your own
- Deleted does not always mean goneThe card, not the book
- Cloud forensics depends on provider evidenceYou get what comes through the hatch