Digital Forensics / Basic: scope, integrity, and interpretation / Lesson 2

Separate byte integrity from provenance

Use digest comparisons precisely while retaining the origin and handling questions they cannot answer.

About 4 min readContent reviewed 2026-10-28

On this page

Lesson goals

Explain the supported claim of a cryptographic digest comparison.
Track source, working copy, transformation, and derived output separately.

Ask whether bytes changed and where they came from

A digest can help compare byte sequences, while provenance concerns origin and history. Two files can have matching digests yet both come from an incomplete or misleading source. Conversely, a useful derived report may intentionally differ from the source because it was decoded, filtered, or redacted. Name each object and the claim made about it. The course uses author-created in-memory bytes, so there is no real acquisition to authenticate. Learning the distinction prevents a hash match from becoming an unsupported claim about completeness, truth, identity, or legal treatment.

Compare exact bytes with an explicit algorithm

The first program computes SHA-256 for public fixture bytes, verifies an identical copy, and detects a one-byte content change. The expected digest is calculated locally for demonstration; it is not an independently authenticated reference. Record the algorithm and exact object boundary in real analytical notes. A filename or displayed text is not the byte sequence itself, and different newline or encoding choices change that sequence. Do not describe hashing as encryption, and do not use the example to claim an actual device image or evidence item was preserved.

python Compare public byte fixtures locally

import hashlib
source = b"lab-record=4\n"
copy = bytes(source)
changed = b"lab-record=5\n"
expected = hashlib.sha256(source).hexdigest()
assert hashlib.sha256(copy).hexdigest() == expected
assert hashlib.sha256(changed).hexdigest() != expected
assert len(expected) == 64
print("fixture digest equality and change checked")

Expected output

fixture digest equality and change checked

The complete program hashes three in-memory byte values and reads no file or device. It demonstrates equality and change detection for this fixture, with no claim of authenticated acquisition, physical preservation, or admissibility.

Identify transformations rather than hiding them

An analyst may normalize line endings for a comparison, but the normalized output must remain a derived object with its own method record. Preserve the original fixture and avoid silently replacing it. The second program shows equal normalized text derived from different original bytes while their original digests differ. That is not a contradiction: the comparisons answer different questions. The example uses only a declared newline transformation and does not imply that normalization is appropriate for every artifact. Binary formats and significant whitespace can make an apparently harmless transformation destructive.

python Keep original equality separate from derivative equality

import hashlib
a = b"event=1\r\n"
b = b"event=1\n"
normalize = lambda value: value.replace(b"\r\n", b"\n")
assert a != b
assert hashlib.sha256(a).digest() != hashlib.sha256(b).digest()
assert normalize(a) == normalize(b)
print("original bytes differ; declared derivatives match")

Expected output

original bytes differ; declared derivatives match

The complete program performs one explicit newline replacement in memory. No original is overwritten. The matching derivatives establish only equality after that transformation, not identity of the original byte streams or their histories.

Retain the relationship between analytical objects

Use stable local identifiers for the source fixture, working copy, parsed table, and final report. Record the input digest, transformation version, parameters, output digest, and analyst action where relevant. A digest alone does not explain which transformation ran or whether a row was omitted. Avoid invented handling events that imply real collection or custody. If a real process is being documented, the accountable organization must use its approved records and controls. In this course, all history describes classroom generation and local derivation only.

Write the narrow integrity conclusion

A careful statement says that the compared byte objects matched under SHA-256 at the recorded analytical step, subject to the algorithm and trustworthy identification of the objects. It does not state that the content is true or complete. If a mismatch appears, preserve both objects and investigate the expected transformation, truncation, encoding, or wrong-object hypothesis before overwriting anything. A changed derivative can be legitimate; an unexplained source change needs a clearly documented response. The local examples establish neither actual evidence authenticity nor any jurisdiction’s admissibility requirements.

Common errors and fixes

A matching digest is called a complete true record

Why it happens: Integrity is confused with provenance and content reliability.
How to fix it: Separate byte comparison from origin and completeness claims.
Prevent it next time: Attach object identity and scope to every digest conclusion.

Normalized output replaces the source

Why it happens: A derivative is treated as the original object.
How to fix it: Preserve the original and record transformation and output separately.
Prevent it next time: Use explicit source-to-derivative identifiers.

A mismatch is fixed by recomputing the expected value

Why it happens: The unexplained change is erased.
How to fix it: Preserve both observations and investigate the object and method.
Prevent it next time: Require a rationale for every expected-digest update.

Check your understanding

1. Two decoded texts match but their source digests differ. Is one result necessarily wrong?

Show worked solution

No. Different encodings or newline bytes can decode or normalize to equal text while original byte streams differ. State the decoding or transformation rule and keep both comparisons. Do not promote equality of a derivative to identity of originals or assume a malicious cause without further evidence.

2. What should a note say when a local copy matches the source fixture?