Know exactly what was hashed
An acquired data stream, an evidence-container file and an exported document are different objects. Label the algorithm and object beside each value. Without that description, a long hexadecimal string is easy to misinterpret during handover.
When verifying a transfer, compare the same file or data stream on both sides using the same algorithm. A mismatch needs investigation. A match supports byte consistency for the objects compared, not a conclusion about the truth of their contents.
View full sizeKeep the acquisition context
Record the exhibit reference, source identifiers, connection hardware, protection method and selected acquisition scope. Retain the Acorn build and imaging settings so a reviewer understands the environment. Explain whether recorded times are local or UTC.
Preserve warnings and read-error information alongside successful results. For a faulty-media job, keep the recovery map as well. The final report should not turn a partly recovered image into a claim that the entire source was readable.
Make verification part of the handover
Forensic Imager provides hashing and acquisition records within the workflow. Store those outputs in the case folder rather than taking a screenshot of the success message and discarding the underlying log. Include a file inventory when handing over several image segments or exports.
During evaluation, ask another examiner to identify the source, scope and verified output using only the handover package. Any question they cannot answer points to a useful improvement before the process is used on real evidence.
What to check
- Hash algorithm and hashed object clearly labelled
- Source, method, scope and any unreadable ranges recorded
- Receiving examiner can verify and identify the delivered output
Common questions
Does a hash prove a document is genuine?
No. It identifies content for comparison. Authenticity, authorship and the significance of that content require other evidence.
Should I remove warnings once the acquisition finishes?
No. Retain the original log and explain relevant warnings. A clean summary is not a reason to discard the underlying record.
Explore the relevant Acorn apps
Put the workflow to the test
Review an acquisition and verification handover
Tell SQFR about the source types, task and equipment you need. We can discuss a focused demonstration and the configuration or quotation that fits. Do not send case evidence or credentials through the enquiry form.