What is used to verify evidence integrity?

• A. Encryption
• B. Hash algorithms
• C. Digital signatures
• D. Backups

Answer: (B)

Verifying evidence integrity means confirming the data hasn’t been altered since collection. The typical method is using hash algorithms. A hash function creates a fixed-length fingerprint of the evidence. It’s deterministic—the same data always yields the same fingerprint—and even a tiny change to the data produces a different fingerprint. By recording the original hash and later recomputing and comparing the hash, you can tell if the evidence has remained unchanged, which is essential for a valid chain of custody.

This approach focuses on integrity: it doesn’t by itself protect confidentiality (that would be encryption). Digital signatures can also help by tying the data to a trusted signer, offering both integrity and authenticity, but the core tool for verifying integrity alone is the hash value. Backups, while important for preservation, are not the mechanism used to verify that the evidence hasn’t been altered. For best practice, use a strong cryptographic hash (like SHA-256) and re-check the hash when needed to ensure ongoing integrity.