The integrity of digital evidence describes the verifiable unalteration of a defined digital dataset compared to a documented reference state. In digital forensics, it is a key prerequisite for later determining whether the examined data still corresponds to the secured state or has been altered in the meantime.

This isn't just about files. Digital evidence can include, for example, a forensic hard drive image, a smartphone extraction, a database, an email archive, a memory dump, a log file, or an exported cloud data set.

Integrity, however, does not automatically equate to authenticity, truth, or authorship. A technically unaltered dataset may have been manipulated even before it was backed up. Therefore, in IT forensics, a precise distinction must be made between what can actually be proven through an integrity check and what cannot.

What does integrity of digital evidence mean?

Integrity, in simple terms, means that a certain amount of data has not been changed since a defined point in time.

This point in time is crucial. For example, if a forensic image is created from a hard drive and a cryptographic hash value is calculated immediately afterwards, a verifiable reference state is created.

If the same image is later checked again using the same hashing method and the same hash value is produced, this strongly suggests that the checked data set has not changed since the original calculation.

Integrity testing thus links a specific data set with a specific documented state.

Why is the integrity of digital evidence so important?

Digital information is much easier to alter than many traditional physical pieces of evidence. A file can be copied, overwritten, deleted, or edited without this necessarily being outwardly visible.

Unintentional changes are also possible. Operating systems write metadata, applications create temporary files, and connected storage devices can be modified by automatic system processes.

A forensic investigation must therefore not only find interesting digital traces. It must also make it comprehensible which data set the analysis is based on.

Without this connection, the question may later arise as to whether a finding was already present on the original object of investigation or only arose during a later processing.

Integrity begins before the actual analysis.

A common misconception is to associate integrity solely with the calculation of a hash value. In reality, the protection of digital evidence begins much earlier.

Even the acquisition of a device, its operating state, the selection of the backup method, and the handling of the original can influence the data subsequently examined.

For example, if a classic hard drive without controlled write protection is connected to a normal operating system, automatic write operations can take place.

The subsequently calculated hash value can reliably document the state that exists afterward. However, it does not undo previous changes.

What is a reference state?

A reference state is the defined data state against which subsequent integrity checks are performed.

In practice, this could be, for example, an image created immediately after a forensic examination.

A hash value is documented for this data set. This value can later be used as a reference.

It is important that it is clearly defined which specific data set the reference value describes.

How is digital evidence checked for integrity?

A key method is the use of cryptographic hash functions. This involves calculating a mathematical checksum from a defined set of data.

For modern forensic investigations, SHA-256, for example, can be used.

If the same SHA-256 value is generated again later from exactly the same data set, it can be used to verify that it has not changed compared to the reference state.

Hash values ​​are therefore not merely a documentation formality, but a technically verifiable component of evidence preservation.

What does an identical hash value prove?

An identical cryptographic hash value, when using a suitable modern hash function, strongly suggests that the data sets being checked are bit-identical.

This allows, for example, verification of whether an archived forensic image still corresponds to the originally documented image.

However, the hash value does not tell us whether the data had already been changed before the first hash calculation.

What does a hash value not prove?

A hash value does not prove that the content of a file is true. Nor does it prove who created, modified, or deleted a file.

He also cannot determine on his own whether a document was originally authentic.

The hash value answers a much more narrowly defined technical question: Is the data set now being checked identical to the data set for which the documented reference value was generated?

Integrity and authenticity are not the same thing.

This distinction is particularly important for digital evidence .

Integrity describes the unaltered state of a data set compared to a reference state.

Authenticity, on the other hand, refers to its origin or genuineness.

A manipulated PDF file can, for example, be handed over to an expert and subsequently properly secured forensically. From this point on, its integrity can be reliably verified.

However, the identical hash value does not prove that the PDF was never manipulated before it was handed over.

Integrity and evidentiary value are also not the same thing.

A completely unchanged dataset may be meaningless for a specific question.

Conversely, a technically relevant finding may exist whose documentation history is not optimal.

Integrity is therefore a quality characteristic of the database, but not an automatic statement about the evidentiary significance of a particular artifact.

The evidentiary significance only arises through the professional classification within the specific context of the case.

Why is a screenshot not sufficient as proof of integrity?

A screenshot merely documents a visible representation of a specific screen content.

It typically does not contain the complete underlying data structures and does not allow for a comprehensive technical integrity check of the source system.

In a messenger chat, for example, a screenshot can show a visible portion of the conversation. However, it does not automatically contain the underlying database, internal message identifiers, system information, or other metadata.

A screenshot can therefore be a relevant document, but it is not equivalent to a forensic backup of the original data.

Why isn't a normal file copy automatically a forensic backup?

A standard file copy can correctly transfer the contents of selected files. However, it does not necessarily capture the complete storage state relevant for an investigation.

Deleted data areas, file system information, and other technical artifacts may be missing.

Furthermore, it must be possible to trace when the files were copied and whether any changes had already taken place before the copy.

The integrity of the copied files can subsequently be checked using hash values. However, this does not yet create a complete forensic data disk backup from the original file selection.

What is the significance of a bitwise backup?

With traditional data storage media, sector-wise or block-wise backup can create a comprehensive representation of the addressable storage area.

The analysis can then be performed on this backed-up data set, while the original remains as untouched as possible.

This reduces the risk of the actual investigation altering the original data carrier.

Why are write blockers used?

A write blocker is designed to prevent an investigation computer from transmitting write commands to an original data carrier.

This is important because operating systems can perform write operations independently when a storage device is connected.

Hardware or suitable software write protection can reduce this risk.

However, write blockers are not suitable for every type of device. Smartphones, soldered-on memory, or live systems require different backup strategies.

Can evidence be altered despite a write blocker?

A correctly implemented write blocker prevents write commands via the controlled data path. However, it does not solve every conceivable integrity problem.

For example, internal controller processes can play a role in flash memory. Furthermore, errors may have already occurred before the connection to the write blocker.

The write blocker is therefore a technical protective tool within a larger forensic process.

What does integrity mean in the context of an HDD?

With traditional magnetic hard drives, the logically addressable storage can often be backed up very comprehensively, sector by sector.

If the original is protected against write access during the acquisition process and the resulting image is subsequently verified, a highly reproducible basis for investigation is created.

However, reading errors or damaged areas must be documented.

What does integrity mean in the context of an SSD?

The situation is more complex with SSDs. A controller with its own memory management operates between the operating system and the physical flash memory cells.

TRIM, Garbage Collection and Wear Leveling influence the internal organization of the data.

A forensic image can therefore document the integrity of the actually captured logical data. However, this does not automatically mean that every physical flash cell was unaltered or immediately accessible.

Why is this distinction important for SSDs?

The term "original state" can be misunderstood when referring to modern storage media.

An SSD partially changes its internal storage organization independently. Therefore, the physical location of certain data does not necessarily have to permanently correspond to the logical address visible to the operating system.

Forensic documentation should therefore precisely describe which data layer was actually secured.

What does integrity mean in the context of smartphones?

Smartphones present a particular challenge. Modern devices use hardware-based encryption, secure key management, and complex operating system mechanisms.

A classic sector-by-sector backup, as with a removed HDD, is therefore often not possible.

Integrity must refer to the actual extracted data set. Documentation should be provided of which device was examined, which extraction method was used, and which data set resulted from it.

Why might a smartphone scan change the device's condition?

A switched-on smartphone is a dynamic system. Background processes continue to run, logs can be updated, and applications can modify data.

Establishing a connection to an investigation computer can also trigger technical changes in state.

Some acquisition methods require certain controlled interactions with the device.

Professional integrity therefore does not mean the unrealistic claim that under no circumstances may a single bit on the original device be altered. What is crucial is to avoid alterations as far as possible and to document necessary or technically unavoidable interventions in a traceable manner.

What does integrity mean for a running computer?

Even a running computer is constantly changing. RAM, temporary files, event logs, and network states can change within seconds.

Therefore, a completely static initial situation is technically unattainable in live forensics.

The task, rather, is to secure the necessary data with interventions that are as controlled as possible and to document these interventions in a traceable manner.

Why can turning off a computer also affect the integrity of evidence?

While switching off prevents further normal operating system activities, it also destroys volatile data in the RAM.

Furthermore, in encrypted systems, a currently decrypted state can be lost.

Therefore, "switch off the device immediately" is not a universally correct forensic rule.

The decision must be made based on the system state and the question being investigated.

What does integrity mean in RAM data?

RAM is volatile and changes constantly during operation.

A RAM image therefore documents a specific achievable state during a particular backup process.

The hash value of the generated memory dump can then be used to verify its continued integrity.

However, he cannot prove that the working memory did not change during the acquisition itself.

What does integrity mean for cloud data?

With cloud services, an investigator typically does not have direct access to the provider's physical storage media.

Instead, the backup is performed, for example, via an API, an account export, or other provided interfaces.

The integrity documentation must therefore focus on the data actually received.

Relevant factors include the source, account, backup time, method used, and the files generated.

Is it possible to verify the physical integrity of a cloud hard drive?

Not usually directly as an external investigator.

Therefore, one's own forensic statement should be limited to the actually accessible and secured data level.

It is precisely this transparent demarcation that increases the professional quality of an investigation.

What does integrity mean in emails?

Integrity checks for emails can refer to different levels.

An exported message can, for example, be hashed as an EML file. Similarly, a complete mailbox archive can be backed up and audited as a data set.

The hash value of this file then documents its unaltered state, but does not automatically prove the authenticity of the original sender.

This may require additional information such as mail headers, server data, and other technical traces.

What does integrity mean in log files?

Log files can play an important role in cyber incidents, data leaks, or unauthorized access.

When relevant logs are exported, it should be traceable which system they come from, when they were backed up, and whether the exported data was subsequently modified.

A hash value can verify the integrity of the secured export.

However, he cannot prove on his own that the original logging system was never tampered with before the backup.

What does integrity mean in databases?

Databases are often dynamic systems. During operation, data records are modified, indexes are updated, and transactions are carried out.

A forensic backup must therefore take into account whether a consistent copy, an export, or another defined database was created.

Only this generated inventory can then be treated as a reference state and secured, for example, via hash values.

What role does the chain of custody play?

The Chain of Custody complements the technical integrity check with organizational traceability.

A hash value can show that a particular set of data has remained unchanged. However, it does not say who received, transported, stored, or examined the evidence.

The chain of evidence documents these events.

Technical integrity and chain of custody should therefore not be confused.

Can a perfect chain of custody replace missing hash values?

No. Careful handover documentation and a technical integrity check serve different functions.

A chain of evidence can excellently document who has stored an image. However, without technical verification information, it cannot automatically be concluded that the data it contains has remained unchanged.

Conversely, an identical hash value cannot explain who had access to the data.

Why should the original be stored in the most protected way possible?

After successful preservation, the original evidence or primary forensic evidence can be retained as a reference.

The actual analysis is carried out on a working copy, as far as is technically feasible.

This allows analysis programs to create files, build indexes, or perform other processing steps without altering the archived reference backup.

Why is a working copy useful?

Forensic analysis programs process large amounts of data and often generate their own databases, indexes, preview files, and investigation results.

A separate working environment prevents such analysis processes from being mixed with the unchanged reference backup.

If a new analysis is required later, a working basis can be created again from the original backup.

What happens if the hash value of a backup changes?

A different hash value initially only means that the two data sets being checked differ.

This is an important warning sign, but not yet an explanation.

The cause could be an actual change, a corrupted file, a transmission error, a different container structure, or simply the fact that different data areas were hashed.

The deviation must therefore be technically investigated.

Does a different hash value automatically constitute proof of manipulation?

No.

He first proves that the compared datasets are not identical, provided the same hash function was correctly applied to comparable data.

The reason they are different cannot be determined from the hash value alone.

What happens if there are read errors during a backup?

Damaged data carriers may contain sectors that cannot be read or can only be read unreliably.

A forensic analysis can still capture a significant portion of the data carrier.

It is crucial that reading errors are documented and that it remains traceable how the tool used dealt with unreadable areas.

A hash value of the generated image can then be used to check its integrity. However, it does not prove that previously unreadable sectors have been successfully read.

Can a damaged image still be considered intact?

Yes, if "integer" means that the file has remained unchanged since a specific reference point in time.

An already incomplete or damaged backup can have a stable hash value.

This further illustrates why integrity and completeness are different properties.

Integrity is not the same as completeness.

A data set can be completely unchanged and yet still lack information.

For example, a logical smartphone extraction can be technically sound, even though it does not contain all of the device's data due to the chosen extraction method.

The integrity check therefore says nothing about whether the backup method was able to capture all information relevant to the question at hand.

Integrity is not the same as correctness.

Even factually incorrect information can be perfectly honest.

If someone enters incorrect information into a document and the file subsequently remains unchanged, a hash value merely confirms that the file has not been altered.

He cannot judge whether the statement contained therein is true or false.

Integrity is not the same as authorship.

An identical hash value can show that two files are identical in content.

However, he cannot determine which person created the file.

To assign the information to a user or a natural person, further artifacts and contextual information must be examined.

What is the significance of integrity in cases of suspected data theft?

In the event of a data theft, digital traces may be distributed across multiple systems.

A company computer may contain USB artifacts, an external storage device may contain copies of confidential files, and a server may contain additional access logs.

In order for this information to be compared, the respective data sources must be clearly identified and secured.

Hash values ​​can, for example, show that a file on an external medium is identical in content to a file from a company's archive.

However, the actual copying process and the person involved must be reconstructed based on further evidence.

What role does integrity play in an expert opinion?

An expert report should indicate on which data basis the technical findings are based.

Especially in complex digital investigations, it is therefore advisable to document investigation objects, security methods and relevant integrity checks in a traceable manner.

This allows a knowledgeable third party to better understand the path from the original object of investigation to the evaluated data set.

The existing website for the expert office for IT and mobile forensics also describes this requirement for comprehensible evidence preservation and documentation.

Practical example: Hard drive of a company computer

A company suspects that an employee copied confidential data before leaving the company.

The company computer's data storage device is backed up under controlled conditions. A SHA-256 value is documented for the generated data set.

The actual examination is carried out on a working copy.

Several months later, a second expert is to review the analysis. Before this review begins, the SHA-256 value of the archived outgoing backup is calculated again.

If this matches the originally documented value, it can be verified that this exact data set has remained unchanged since the original backup.

Practical example: Confidential file on a USB stick

A confidential project file exists on a company server. During an investigation, a file with the same name is found on a USB stick.

The filename alone is not sufficient proof of identical content.

If both files yield the same SHA-256 value, this strongly suggests that their hashed contents are identical.

However, this does not prove when the file was transferred to the USB stick or who copied it there.

Practical example: Messenger screenshot

A person hands over a screenshot of an alleged messenger chat.

The screenshot can be hashed immediately after being sent. This allows you to later check whether exactly this image file was modified.

However, the hash value proves neither that the chat shown actually existed on the alleged smartphone, nor that the messages shown are authentic.

For a more in-depth examination, the original data source would be significantly more informative.

Practical example: Smartphone extraction

An extraction is performed from a smartphone using a forensic tool.

This extracted material is then documented and protected against changes.

Integrity now refers precisely to this generated dataset.

Whether the extraction contains all the information available on the smartphone is another question and depends on the device, operating system, security status and extraction method.

Practical example: Cloud export

A data set is exported from a cloud account. After the download is complete, the downloaded files are backed up and hash values ​​are generated.

This allows for monitoring the continued unchangedness of the exported stock.

However, the hash value does not prove that the cloud provider has delivered all data that ever existed or that no files were deleted before the export.

Typical mistakes in handling evidence integrity

A common mistake is to consider an identical hash value as complete proof of authenticity.

Equally problematic is the assumption that forensic preservation must be possible under all technical circumstances completely without any change in the state of the original system.

This is often unrealistic with live systems and smartphones. Controlled procedures and transparent documentation are crucial.

Further errors occur if it is not documented which data was hashed, if different hash algorithms are compared, or if integrity is confused with completeness.

How should integrity be documented?

The documentation should clearly indicate which object of investigation or which data set was examined.

In a hash check, the algorithm used and the resulting hash value should be clearly assignable to the relevant data set.

Depending on the case under investigation, the time, tool used, evidence identifier, image file and any reading errors that occurred can also be documented.

The goal is not to produce the most comprehensive documentation possible for its own sake, but rather to ensure the technical traceability of the relevant investigation steps.

FAQ on the integrity of digital evidence

What does integrity of digital evidence mean, explained simply?

Integrity means that it can be verified whether a specific digital dataset has changed since a documented reference point in time.

How is the integrity of digital evidence verified?

An important method is the calculation of cryptographic hash values. The same hash value for the same defined data set enables very strong technical control over its integrity.

What is a hash value?

A hash value is a mathematically calculated checksum of a digital dataset. Modern methods such as SHA-256 are used, among other things, for integrity control.

Is SHA-256 suitable for digital evidence?

Yes. SHA-256 is an established cryptographic hash function and is suitable for modern integrity checks of digital data sets.

Does an identical hash value prove the authenticity of a file?

No. It confirms the unchanged state compared to the underlying reference state, not automatically the original authenticity or origin.

Can a manipulated file be an integer?

Yes. If a file that has already been manipulated is subsequently hashed and then not modified again, it remains intact compared to this later reference state.

Is integrity the same as authenticity?

No. Integrity describes unalteredness. Authenticity concerns the question of genuineness and origin.

Is integrity the same as completeness?

No. An unaltered dataset can be incomplete. For example, a smartphone extraction might be accurate even though the method used could only capture a portion of the available data.

Is integrity the same as evidentiary value?

No. Integrity refers to the quality and unalterability of the data. The significance of an artifact for a specific situation must be assessed separately.

What happens if two hash values ​​are different?

Then the hashed data sets differ. The reasons for these differences must then be investigated.

Does a different hash value prove manipulation?

Not automatically. Technical errors, different data ranges, or varying container states can also lead to differing values.

Can a screenshot be an integer?

Yes. The screenshot file itself can be hashed and thus checked against later alterations. However, this does not automatically prove the authenticity of the content shown.

Can a normal file copy be integer?

Yes. The copied files can then be checked using hash values. However, this does not mean that the copy represents a complete forensic image of the original storage medium.

Why is a write blocker used?

It is designed to prevent unintentional write access to an original data carrier and thus reduce avoidable changes during backup.

Does every forensic backup need a write blocker?

No. It depends on the device class and backup method. Smartphones and certain live systems require different procedures.

Can a smartphone be examined without any alteration?

This cannot be guaranteed across the board. Smartphones are dynamic systems. Professional forensics attempts to minimize changes and to document any technically necessary interventions in a traceable manner.

Can a switched-on computer remain unchanged?

No. A running operating system constantly modifies volatile and partially persistent data. Therefore, live forensics requires controlled and documented interventions.

Can turning off a computer destroy evidence?

Yes. Volatile RAM contents are lost in the process. On encrypted systems, a previously decrypted state can also be lost.

What is the Chain of Custody?

The chain of custody documents the handling of evidence and relevant transfers or changes of responsibility. It complements the technical integrity check, but does not replace it.

Can a hash value replace the chain of custody?

No. A hash value controls a set of data. It does not document which person received or modified a piece of evidence and when.

Why is the analysis performed on working copies?

This allows a primary forensic evidence to remain unchanged as a reference, while analysis tools are used on a separate working basis.

Can a forensic image be used despite reading errors?

Yes. The extracted data can still be of considerable value for research. However, the reading errors and their correction must be documented and taken into account during interpretation.

Is a hash value alone sufficient for an expert opinion?

No. It is a technical component of integrity control. A verifiable expert opinion additionally requires a suitable database, documented methodology, expert analysis, and appropriate interpretation.

Can integrity be restored retroactively?

A subsequently generated hash value can define a reference state from that point onward. However, it cannot retrospectively prove that the data before that point remained unchanged.

Why is the timing of the first backup so important?

The sooner relevant data is backed up in a controlled manner, the more clearly its subsequent state can be documented. Changes that occurred before the backup cannot be reversed by later integrity checks.

What the integrity of digital evidence actually says

The integrity of digital evidence answers a clearly defined question: Is the examined data set still the same as the documented reference set?

This statement is extremely valuable for professional digital forensics, but it should not be overstretched.

Integrity does not automatically prove authenticity, completeness, truth, authorship, or the legal admissibility of a digital piece of evidence.

A reliable investigation therefore combines several levels: controlled data backup, unambiguous identification of the data source, integrity testing, a traceable chain of evidence, and a professionally sound analysis.

This very separation prevents misinterpretations. A hash value does not become a blanket seal of authenticity, a forensic copy does not automatically become complete proof, and a technically intact data set does not become a proven factual assertion without further examination.

Professional evidence integrity therefore means above all one thing: being able to explain at any time in a comprehensible manner which data set was examined, how it was secured and on what technical basis its unaltered state can be verified.

Back to knowledge overview