Overview
Evidence is only trustworthy if its integrity is preserved — proven unaltered from capture to reporting. This lesson covers evidence integrity.
Learning objectives
- Define evidence integrity.
- Explain how integrity is preserved and demonstrated.
- Connect integrity to trustworthy evidence.
Core concept
Evidence integrity means the evidence remains unaltered and trustworthy from the moment of capture through analysis and reporting. If evidence could have been changed, its credibility collapses. Integrity is preserved by secure handling (protected storage, controlled access), avoiding modification, and — for important digital evidence — using cryptographic hashes (from the fundamentals/integrity concepts) to prove a file has not changed (recompute the hash and compare). Demonstrable integrity is what lets the owner (and any later party) rely on the evidence as an accurate record.
How it works
At capture, the tester records evidence and protects it from alteration: storing it securely, limiting who can modify it, and, for key digital artifacts, computing a hash at capture so any later change would be detectable (the hash would differ). Throughout the engagement, evidence is handled to avoid modification, and its integrity can be verified (by comparing hashes) when needed. This mirrors the integrity property from the CIA triad and the checksum/hashing concepts: a matching hash demonstrates the artifact is unchanged. Preserving and being able to prove integrity makes the evidence — and thus the findings — credible.
Practical example
The tester captures a digital artifact demonstrating a finding and computes its hash at capture, recording it. The artifact is stored securely with controlled access. Later, if anyone questions whether it was altered, recomputing the hash and comparing to the recorded value proves it is unchanged (a match) — establishing integrity. Had the artifact been modified, the hashes would differ, revealing tampering. This integrity assurance makes the evidence trustworthy for the report and any subsequent review.
Cybersecurity relevance
Evidence integrity is fundamental to credible findings and is especially important where evidence might face scrutiny (disputes, formal processes). Cryptographic hashing to prove evidence is unaltered applies the integrity/checksum concepts from earlier paths to real assessment practice. In forensics and incident response, integrity (and the related chain-of-custody, next lesson) is essential for evidence to be reliable and, where relevant, admissible. For assessments, demonstrable integrity ensures the owner can fully trust the evidence behind each finding. It is a core professional discipline in handling evidence.
Common mistakes
- Storing evidence insecurely or allowing uncontrolled modification.
- Not hashing important digital evidence at capture, losing the ability to prove it is unaltered.
- Assuming evidence integrity rather than being able to demonstrate it.
Key takeaways
- Evidence integrity means the evidence stays unaltered and trustworthy from capture to reporting; without it, credibility collapses.
- Preserve integrity via secure handling, avoiding modification, and cryptographic hashing (recompute-and-compare) to prove digital artifacts are unchanged.
- Demonstrable integrity applies the CIA-triad/checksum concepts to assessment, is vital where evidence faces scrutiny, and is a core evidence discipline (with chain-of-custody).
Check your understanding
- How can a cryptographic hash demonstrate that a piece of digital evidence has not been altered?
- Why does evidence integrity matter for the credibility of findings?